diff --git a/roles/unbound/templates/unbound.conf.nms01.home.foo.sh.j2 b/roles/unbound/templates/unbound.conf.nms01.home.foo.sh.j2
index 27961bd..155e51a 100644
--- a/roles/unbound/templates/unbound.conf.nms01.home.foo.sh.j2
+++ b/roles/unbound/templates/unbound.conf.nms01.home.foo.sh.j2
@@ -13,6 +13,9 @@ server:
     hide-identity: yes
     hide-version: yes
 
+    tls-upstream: yes
+    tls-cert-bundle: {{ tls_bundle }}
+
     chroot: ""
 
     unblock-lan-zones: yes
@@ -23,9 +26,7 @@ remote-control:
 
 forward-zone:
     name: "."
-    forward-addr: 172.20.20.10
-    forward-addr: 172.20.21.1
-    forward-addr: 172.20.21.2
+    forward-addr: 172.20.20.10@853#dns.home.foo.sh
 
 auth-zone:
     name: "oob.foo.sh"
diff --git a/roles/unbound/templates/unbound.conf.print01.home.foo.sh.j2 b/roles/unbound/templates/unbound.conf.print01.home.foo.sh.j2
index 4c7c108..8300b08 100644
--- a/roles/unbound/templates/unbound.conf.print01.home.foo.sh.j2
+++ b/roles/unbound/templates/unbound.conf.print01.home.foo.sh.j2
@@ -13,6 +13,9 @@ server:
     hide-identity: yes
     hide-version: yes
 
+    tls-upstream: yes
+    tls-cert-bundle: {{ tls_bundle }}
+
     chroot: ""
 
     unblock-lan-zones: yes
@@ -23,9 +26,7 @@ remote-control:
 
 forward-zone:
     name: "."
-    forward-addr: 172.20.20.10
-    forward-addr: 172.20.21.1
-    forward-addr: 172.20.21.2
+    forward-addr: 172.20.20.10@853#dns.home.foo.sh
 
 auth-zone:
     name: "print.foo.sh"
diff --git a/roles/unbound/templates/unbound.conf.zm02.home.foo.sh.j2 b/roles/unbound/templates/unbound.conf.zm02.home.foo.sh.j2
index 3902949..69ff7af 100644
--- a/roles/unbound/templates/unbound.conf.zm02.home.foo.sh.j2
+++ b/roles/unbound/templates/unbound.conf.zm02.home.foo.sh.j2
@@ -13,6 +13,9 @@ server:
     hide-identity: yes
     hide-version: yes
 
+    tls-upstream: yes
+    tls-cert-bundle: {{ tls_bundle }}
+
     chroot: ""
 
     unblock-lan-zones: yes
@@ -23,9 +26,7 @@ remote-control:
 
 forward-zone:
     name: "."
-    forward-addr: 172.20.20.10
-    forward-addr: 172.20.21.1
-    forward-addr: 172.20.21.2
+    forward-addr: 172.20.20.10@853#dns.home.foo.sh
 
 auth-zone:
     name: "cam.foo.sh"