diff --git a/actions/shadowsocks b/actions/shadowsocks
index 28545fc9b..dba962827 100755
--- a/actions/shadowsocks
+++ b/actions/shadowsocks
@@ -7,6 +7,7 @@ Helper script for configuring Shadowsocks.
 import argparse
 import json
 import os
+import pathlib
 import random
 import string
 import sys
@@ -65,6 +66,19 @@ def subcommand_setup(_):
         }
         _merge_config(initial_config)
 
+    # Commit 50e5608331330b37c0b9cce846e34ccc193d1b0d incorrectly sets the
+    # StateDirectory without setting DynamicUser. Buster's shadowsocks will
+    # then create directory /var/lib/shadowsocks-libev/freedombox/ and refuse
+    # to delete is in later versions when DynamicUser=yes needs it to be a
+    # symlink.
+    action_utils.service_daemon_reload()
+    wrong_state_dir = pathlib.Path('/var/lib/shadowsocks-libev/freedombox/')
+    if not wrong_state_dir.is_symlink() and wrong_state_dir.is_dir():
+        wrong_state_dir.rmdir()
+
+    if action_utils.service_is_enabled(shadowsocks.managed_services[0]):
+        action_utils.service_restart(shadowsocks.managed_services[0])
+
 
 def subcommand_get_config(_):
     """Read and print Shadowsocks configuration."""
diff --git a/plinth/modules/shadowsocks/__init__.py b/plinth/modules/shadowsocks/__init__.py
index 64b7f5be3..705c65447 100644
--- a/plinth/modules/shadowsocks/__init__.py
+++ b/plinth/modules/shadowsocks/__init__.py
@@ -15,7 +15,7 @@ from plinth.utils import format_lazy
 
 from .manifest import backup  # noqa, pylint: disable=unused-import
 
-version = 2
+version = 3
 
 managed_services = ['shadowsocks-libev-local@freedombox']
 
diff --git a/plinth/modules/shadowsocks/data/lib/systemd/system/shadowsocks-libev-local@.service.d/freedombox.conf b/plinth/modules/shadowsocks/data/lib/systemd/system/shadowsocks-libev-local@.service.d/freedombox.conf
index ef74f9383..ae1330adf 100644
--- a/plinth/modules/shadowsocks/data/lib/systemd/system/shadowsocks-libev-local@.service.d/freedombox.conf
+++ b/plinth/modules/shadowsocks/data/lib/systemd/system/shadowsocks-libev-local@.service.d/freedombox.conf
@@ -1,2 +1,3 @@
 [Service]
 StateDirectory=shadowsocks-libev/%i
+DynamicUser=yes