diff --git a/luci-app-adguardhome/root/etc/init.d/adguardhome b/luci-app-adguardhome/root/etc/init.d/adguardhome
index 26429aae..4edb80c5 100755
--- a/luci-app-adguardhome/root/etc/init.d/adguardhome
+++ b/luci-app-adguardhome/root/etc/init.d/adguardhome
@@ -8,6 +8,30 @@ STOP=89
 PROG=/usr/bin/AdGuardHome
 USE_PROCD=1
 
+config_cb() {
+	[ $# -eq 0 ] && return
+
+	option_cb() {
+		local option="$1"
+		local value="$2"
+
+		case $option in
+
+		# Support old option names
+		config)
+			option='config_file'
+			;;
+
+		workdir)
+			option='work_dir'
+			;;
+
+		esac
+
+		eval $option="$value"
+	}
+}
+
 boot() {
 	ADGUARDHOME_BOOT=1
 	start "$@"
@@ -117,36 +141,42 @@ stop_forward_dnsmasq() {
 
 # Start AdGuard Home service
 start_service() {
-    local AdGuardHome_PORT
-    local dnsmasq_port
-    local DNSMASQ_SERVER
-    
-    if [ -n "$ADGUARDHOME_BOOT" ]; then
+	if [ -n "$ADGUARDHOME_BOOT" ]; then
 		# Do not start yet, wait for triggers
 		return 0
 	fi
 
-    # Load configuration
-    config_load adguardhome
-    config_get CONFIG_FILE config config_file "/etc/adguardhome/adguardhome.yaml"
-    config_get PID_FILE config pidfile "/run/adguardhome.pid"
-    config_get WORK_DIR config work_dir "/var/lib/adguardhome"
-    config_get REDIRECT config redirect "none"
-    config_get_bool ENABLED config enabled 0
+	local config_file='/etc/adguardhome/adguardhome.yaml'
+	local group='adguardhome'
+	local user='adguardhome'
+	local verbose=0
+	local work_dir='/var/lib/adguardhome'
+	local redirect='none'
+	local enabled=0
+
+	config_load 'adguardhome'
+
+    [ "$enabled" -eq 0 ] && return 1
+
+	local config_dir
+	config_dir=$(dirname "$config_file")
+	if [ "$config_dir" = '/etc' ]; then
+		echo "AdGuard Home config must be stored in its own directory, and not in /etc" >&2
+		return 1
+	fi
+	mkdir -m 0700 -p "$config_dir"
+	chown -R "$user":"$group" "$config_dir"
+
+	mkdir -m 0700 -p "$work_dir"
+	chown -R "$user":"$group" "$work_dir"
     
     # Get ports configuration
-    AdGuardHome_PORT=$(awk '/dns:/{f=1} f&&/port:/{split($0,a,": *");print a[2];exit}' "$CONFIG_FILE")
-    dnsmasq_port=$(uci -q get dhcp.@dnsmasq[0].port)
-    DNSMASQ_SERVER=$(uci -q get dhcp.@dnsmasq[0].server)
-    
-    # Check if service is enabled
-    [ "$ENABLED" -eq 0 ] && return 1
-
-    # Create working directory if needed
-    [ -d "$WORK_DIR" ] || mkdir -m 0755 -p "$WORK_DIR"
+    local AdGuardHome_PORT=$(awk '/dns:/{f=1} f&&/port:/{split($0,a,": *");print a[2];exit}' "$config_file")
+    local dnsmasq_port=$(uci -q get dhcp.@dnsmasq[0].port)
+    local DNSMASQ_SERVER=$(uci -q get dhcp.@dnsmasq[0].server)
 
     # Configure redirect mode
-    case "$REDIRECT" in
+    case "$redirect" in
         "redirect")
             set_redirect "$AdGuardHome_PORT"
             ;;
@@ -154,40 +184,61 @@ start_service() {
             set_forward_dnsmasq "$AdGuardHome_PORT" "$DNSMASQ_SERVER"
             ;;
         "exchange")
-            use_port53 "$dnsmasq_port" "$AdGuardHome_PORT" "$CONFIG_FILE"
+            use_port53 "$dnsmasq_port" "$AdGuardHome_PORT" "$config_file"
             ;;
     esac
 
-    # Start service
-    procd_open_instance adguardhome
-    procd_set_param command "$PROG" -c "$CONFIG_FILE" -w "$WORK_DIR" --pidfile "$PID_FILE" --no-check-update
-    procd_set_param stdout 1
-    procd_set_param stderr 1
-    procd_set_param user root
-    procd_set_param respawn
-    procd_close_instance
+    procd_open_instance
+
+	procd_set_param command "$PROG"
+	procd_append_param command --config "$config_file"
+	procd_append_param command --logfile syslog
+	procd_append_param command --no-check-update
+	[ "$verbose" = 1 ] && \
+		procd_append_param command --verbose
+	procd_append_param command --work-dir "$work_dir"
+
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_set_param user "$user"
+	procd_set_param group "$group"
+	procd_set_param capabilities /etc/capabilities/adguardhome.json
+	procd_set_param no_new_privs 1
+	procd_set_param respawn
+
+	# log is needed for logging to syslog instead of stdout
+	# procfs is needed to readlink /proc/self/exe
+	procd_add_jail adguardhome log procfs
+
+	# config directory must be writable to write new config files
+	procd_add_jail_mount_rw "$config_dir"
+	procd_add_jail_mount_rw "$work_dir"
+
+	procd_add_jail_mount /etc/hosts
+	procd_add_jail_mount /etc/ssl/certs
+	config_list_foreach config jail_mount procd_add_jail_mount
+
+	procd_close_instance
 }
 
 # Stop AdGuard Home service
 stop_service() {
-    local AdGuardHome_PORT
-    local dnsmasq_port
-    local DNSMASQ_SERVER
-    
-    # Skip if during boot
-    [ -n "$ADGUARDHOME_BOOT" ] && return 0
+	if [ -n "$ADGUARDHOME_BOOT" ]; then
+		# Do not start yet, wait for triggers
+		return 0
+	fi
 
-    # Load configuration
-    config_load adguardhome
-    config_get CONFIG_FILE config config_file "/etc/adguardhome/adguardhome.yaml"
+	local config_file='/etc/adguardhome/adguardhome.yaml'
+
+	config_load 'adguardhome'
     
     # Get ports configuration
-    AdGuardHome_PORT=$(awk '/dns:/{f=1} f&&/port:/{split($0,a,": *");print a[2];exit}' "$CONFIG_FILE")
-    dnsmasq_port=$(uci -q get dhcp.@dnsmasq[0].port)
-    DNSMASQ_SERVER=$(uci -q get dhcp.@dnsmasq[0].server)
+    local AdGuardHome_PORT=$(awk '/dns:/{f=1} f&&/port:/{split($0,a,": *");print a[2];exit}' "$config_file")
+    local dnsmasq_port=$(uci -q get dhcp.@dnsmasq[0].port)
+    local DNSMASQ_SERVER=$(uci -q get dhcp.@dnsmasq[0].server)
     
     # Clean up configurations
-    rm_port53 "$AdGuardHome_PORT" "$dnsmasq_port" "$CONFIG_FILE"
+    rm_port53 "$AdGuardHome_PORT" "$dnsmasq_port" "$config_file"
     clear_redirect
     stop_forward_dnsmasq "$AdGuardHome_PORT" "$DNSMASQ_SERVER"
 }
diff --git a/mihomo/Makefile b/mihomo/Makefile
index 14f7d961..7f9908b9 100644
--- a/mihomo/Makefile
+++ b/mihomo/Makefile
@@ -5,8 +5,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mihomo
-PKG_VERSION:=1.19.20
-PKG_RELEASE:=1
+PKG_VERSION:=1.19.21
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/metacubex/mihomo/tar.gz/v$(PKG_VERSION)?