diff --git a/NEWS b/NEWS
index 6ed72b263..b07e8d904 100644
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,10 @@ Incompatible changes
   <https://www.knot-resolver.cz/documentation/latest/config-cache-predict.html>`_
   for more.
 
+Bugfixes
+--------
+- fix startup with `dnssec: false` (!1548)
+
 
 Knot Resolver 6.0.7 (2024-03-27)
 ================================
diff --git a/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2 b/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
index 31a29beac..05d1fa688 100644
--- a/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
+++ b/manager/knot_resolver_manager/datamodel/templates/dnssec.lua.j2
@@ -26,8 +26,10 @@ modules.load('detect_time_skew')
 modules.unload('detect_time_skew')
 {% endif %}
 
+{% if cfg.dnssec.keep_removed %}
 -- dnssec.keep-removed
 trust_anchors.keep_removed = {{ cfg.dnssec.keep_removed }}
+{% endif %}
 
 {% if cfg.dnssec.refresh_time %}
 -- dnssec.refresh-time