diff --git a/daemons/pacemakerd/pacemaker.service.in b/daemons/pacemakerd/pacemaker.service.in
index 0363a2259c..3fd53d9ffb 100644
--- a/daemons/pacemakerd/pacemaker.service.in
+++ b/daemons/pacemakerd/pacemaker.service.in
@@ -1,97 +1,103 @@
 [Unit]
 Description=Pacemaker High Availability Cluster Manager
 Documentation=man:pacemakerd
 Documentation=https://clusterlabs.org/pacemaker/doc/
 
 # DefaultDependencies takes care of sysinit.target,
 # basic.target, and shutdown.target
 
 # We need networking to bind to a network address. It is recommended not to
 # use Wants or Requires with network.target, and not to use
 # network-online.target for server daemons.
 After=network.target
 
 # Time syncs can make the clock jump backward, which messes with logging
 # and failure timestamps, so wait until it's done.
 After=time-sync.target
 
 # Managing systemd resources requires DBus.
 After=dbus.service
 Wants=dbus.service
 
 # Some OCF resources may have dependencies that aren't managed by the cluster;
 # these must be started before Pacemaker and stopped after it. The
 # resource-agents package provides this target, which lets system adminstrators
 # add drop-ins for those dependencies.
 After=resource-agents-deps.target
 Wants=resource-agents-deps.target
 
 After=syslog.service
 After=rsyslog.service
 After=corosync.service
 Requires=corosync.service
 
+# If Pacemaker respawns repeatedly, give up after this many tries in this time
+StartLimitBurst=5
+StartLimitIntervalSec=25s
 
 [Install]
 WantedBy=multi-user.target
 
 
 [Service]
 Type=simple
 KillMode=process
 NotifyAccess=main
 EnvironmentFile=-@CONFIGDIR@/pacemaker
 EnvironmentFile=-@CONFIGDIR@/sbd
 SuccessExitStatus=100
 
 ExecStart=@sbindir@/pacemakerd
 
 # Systemd v227 and above can limit the number of processes spawned by a
 # service. That is a bad idea for an HA cluster resource manager, so disable it
 # by default. The administrator can create a local override if they really want
 # a limit. If your systemd version does not support TasksMax, and you want to
 # get rid of the resulting log warnings, comment out this option.
 TasksMax=infinity
 
 # If pacemakerd doesn't stop, it's probably waiting on a cluster
 # resource.  Sending -KILL will just get the node fenced
 SendSIGKILL=no
 
+# Systemd's default of respawning a failed service after 100ms is too aggressive
+RestartSec=1s
+
 # If we ever hit the StartLimitInterval/StartLimitBurst limit, and the
 # admin wants to stop the cluster while pacemakerd is not running, it
 # might be a good idea to enable the ExecStopPost directive below.
 #
 # However, the node will likely end up being fenced as a result, so it's
 # not enabled by default.
 #
 # ExecStopPost=/usr/bin/killall -TERM pacemaker-attrd pacemaker-based \
 #              pacemaker-controld pacemaker-execd pacemaker-fenced \
 #              pacemaker-schedulerd
 
 # If you want Corosync to stop whenever Pacemaker is stopped,
 # uncomment the next line too:
 #
 # ExecStopPost=/bin/sh -c 'pidof pacemaker-controld || killall -TERM corosync'
 
 # Pacemaker will restart along with Corosync if Corosync is stopped while
 # Pacemaker is running.
 # In this case, if you want to be fenced always (if you do not want to restart)
 # uncomment ExecStopPost below.
 # 
 # ExecStopPost=/bin/sh -c 'pidof corosync || \
 #              /usr/bin/systemctl --no-block stop pacemaker'
 
 # When the service functions properly, it will wait to exit until all resources
 # have been stopped on the local node, and potentially across all nodes that
 # are shutting down.  The default of 30min should cover most typical cluster
 # configurations, but it may need an increase to adapt to local conditions
 # (e.g. a large, clustered database could conceivably take longer to stop).
 TimeoutStopSec=30min
 TimeoutStartSec=60s
 
 # Restart options include: no, on-success, on-failure, on-abort or always
 Restart=on-failure
 
 # crm_perror() writes directly to stderr, so ignore it here
 # to avoid double-logging with the wrong format
 StandardError=null