diff --git a/roles/master/defaults/main.yml b/roles/master/defaults/main.yml
index cfafdaf..61ac29f 100644
--- a/roles/master/defaults/main.yml
+++ b/roles/master/defaults/main.yml
@@ -20,4 +20,4 @@ knot_dnssec_policy_nsec3: 'on'
 knot_dnssec_policy_ksk_shared: 'on'
 knot_dnssec_policy_ksk_size: 384
 knot_dnssec_policy_zsk_size: 384
-knot_dnssec_policy_cds_publish: 'always'
+knot_dnssec_policy_cds_publish: 'double-ds'