For now have bind.service started with root and let it drop it's own permissions. There's apparently other ways to do this in systemd, dunno what that looks like.