diff --git a/README.md b/README.md
index 94d45d9..c4e6a6d 100644
--- a/README.md
+++ b/README.md
@@ -219,7 +219,7 @@ the following precedence (highest to lowest):
 |---------------------------------|--------------------------------------------|-------------|
 | `PORT`                          | HTTP listen port                           | `8080`      |
 | `DNSWATCHER_DEBUG`              | Enable debug logging                       | `false`     |
-| `DNSWATCHER_DATA_DIR`           | Directory for state file                   | `./data`    |
+| `DNSWATCHER_DATA_DIR`           | Directory for state file                   | `/var/lib/dnswatcher` |
 | `DNSWATCHER_TARGETS`            | Comma-separated DNS names (auto-classified via PSL) | `""`  |
 | `DNSWATCHER_SLACK_WEBHOOK`      | Slack incoming webhook URL                 | `""`        |
 | `DNSWATCHER_MATTERMOST_WEBHOOK` | Mattermost incoming webhook URL            | `""`        |
@@ -244,7 +244,7 @@ list of DNS names before starting.
 ```sh
 PORT=8080
 DNSWATCHER_DEBUG=false
-DNSWATCHER_DATA_DIR=./data
+DNSWATCHER_DATA_DIR=/var/lib/dnswatcher
 DNSWATCHER_TARGETS=example.com,example.org,www.example.com,api.example.com,mail.example.org
 DNSWATCHER_SLACK_WEBHOOK=https://hooks.slack.com/services/T.../B.../xxx
 DNSWATCHER_MATTERMOST_WEBHOOK=https://mattermost.example.com/hooks/xxx
diff --git a/internal/config/config.go b/internal/config/config.go
index 3e6df75..264b90b 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -94,7 +94,7 @@ func setupViper(name string) {
 
 	viper.SetDefault("PORT", defaultPort)
 	viper.SetDefault("DEBUG", false)
-	viper.SetDefault("DATA_DIR", "./data")
+	viper.SetDefault("DATA_DIR", "/var/lib/"+name)
 	viper.SetDefault("TARGETS", "")
 	viper.SetDefault("SLACK_WEBHOOK", "")
 	viper.SetDefault("MATTERMOST_WEBHOOK", "")
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
index e20a715..2917818 100644
--- a/internal/config/config_test.go
+++ b/internal/config/config_test.go
@@ -44,7 +44,7 @@ func TestNew_DefaultValues(t *testing.T) {
 
 	assert.Equal(t, 8080, cfg.Port)
 	assert.False(t, cfg.Debug)
-	assert.Equal(t, "./data", cfg.DataDir)
+	assert.Equal(t, "/var/lib/dnswatcher", cfg.DataDir)
 	assert.Equal(t, time.Hour, cfg.DNSInterval)
 	assert.Equal(t, 12*time.Hour, cfg.TLSInterval)
 	assert.Equal(t, 7, cfg.TLSExpiryWarning)
@@ -245,7 +245,7 @@ func TestStatePath(t *testing.T) {
 		dataDir string
 		want    string
 	}{
-		{"default", "./data", "./data/state.json"},
+		{"default", "/var/lib/dnswatcher", "/var/lib/dnswatcher/state.json"},
 		{"absolute", "/var/lib/dw", "/var/lib/dw/state.json"},
 		{"nested", "/opt/app/data", "/opt/app/data/state.json"},
 		{"empty", "", "/state.json"},