diff --git a/roles/samba-cert/handlers/main.yml b/roles/samba-cert/handlers/main.yml
index 6bea0db..3c02ff6 100644
--- a/roles/samba-cert/handlers/main.yml
+++ b/roles/samba-cert/handlers/main.yml
@@ -3,3 +3,5 @@
     name: samba-cert-renew.timer
     state: restarted
 
+- name: save firewalld-configuration
+  command: firewall-cmd --runtime-to-permanent
diff --git a/roles/samba-cert/tasks/main.yml b/roles/samba-cert/tasks/main.yml
index 9310a35..3d38c47 100644
--- a/roles/samba-cert/tasks/main.yml
+++ b/roles/samba-cert/tasks/main.yml
@@ -28,6 +28,8 @@
   - 80/tcp
   - 5000/tcp
   when: host_uses_firewalld|d(true)
+  notify:
+  - save firewalld configuration
   tags:
   - firewalld