diff --git a/roles/dns/master/templates/zone.makefile b/roles/dns/master/templates/zone.makefile
index ed8eeb9..d89d5ec 100644
--- a/roles/dns/master/templates/zone.makefile
+++ b/roles/dns/master/templates/zone.makefile
@@ -14,10 +14,11 @@ ${dest}/${db_file}: ${dest}/${db_file}.unchecked
 
 ${dest}/${signed_file}: ${dest}/${db_file}
 	if [[ "$(dir $<)" != "$(dir $@)" ]]; then echo "directories not equal" > /dev/stderr; exit 1; fi
+	cd "$(dir $@)"; \
 	dnssec-signzone \
 		-3 $$(head -c 1000 /dev/urandom | sha1sum | cut -b 1-16) \
 		-a \
 		-N unixtime \
 		-o {{ domain | quote }} \
-		-f "$@" \
-		"$<";
+		-f "$(notdir $@)" \
+		"$(notdir $<)";