diff --git a/src/config.rs b/src/config.rs
index c99d47a..07bf8fa 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1,5 +1,4 @@
 use std::{
-    collections::HashSet,
     env::var,
     path::{Path, PathBuf},
     str::FromStr,
@@ -7,6 +6,7 @@ use std::{
 
 use anyhow::{Error, Result};
 use serde::Deserialize;
+use zbus::{Address, AuthMechanism};
 
 pub mod limits;
 mod xml;
@@ -14,7 +14,6 @@ mod xml;
 use xml::{
     Document, Element, PolicyContext, PolicyElement, RuleAttributes, RuleElement, TypeElement,
 };
-use zbus::AuthMechanism;
 
 #[derive(Clone, Debug, Deserialize, PartialEq)]
 pub enum Access {
@@ -49,11 +48,13 @@ pub struct Config {
     /// This may be useful to avoid affecting the behavior of child processes.
     pub keep_umask: bool,
 
-    /// Address(es) that the bus should listen on.
+    /// Address that the bus should listen on.
     /// The address is in the standard D-Bus format that contains a transport name plus possible
     /// parameters/options.
-    #[serde(default)]
-    pub listen: HashSet<String>,
+    // TODO: warn when multiple `<listen>` elements are defined, as we only support one
+    // TODO: consider implementing `Deserialize` over in zbus crate, then removing this "skip..."
+    #[serde(default, skip_deserializing)]
+    pub listen: Option<Address>,
 
     /// The bus daemon will write its pid to the specified file.
     pub pidfile: Option<PathBuf>,
@@ -105,8 +106,8 @@ impl TryFrom<Document> for Config {
                 Element::Limit => {
                     // NO-OP: deprecated and ignored
                 }
-                Element::Listen(s) => {
-                    config.listen.insert(s);
+                Element::Listen(listen) => {
+                    config.listen = Some(Address::from_str(&listen)?);
                 }
                 Element::Pidfile(p) => config.pidfile = Some(p),
                 Element::Policy(pe) => {
@@ -660,11 +661,10 @@ mod tests {
         assert_eq!(
             config,
             Config {
-                listen: HashSet::from_iter(vec![
-                    String::from("unix:path=/tmp/foo"),
-                    String::from("tcp:host=localhost,port=1234"),
-                    String::from("tcp:host=localhost,port=0,family=ipv4"),
-                ]),
+                listen: Some(
+                    Address::from_str("tcp:host=localhost,port=0,family=ipv4")
+                        .expect("should parse address")
+                ),
                 ..Default::default()
             }
         );
@@ -700,10 +700,10 @@ mod tests {
             config,
             Config {
                 auth: Some(AuthMechanism::External),
-                listen: HashSet::from_iter(vec![
-                    String::from("unix:path=/tmp/foo"),
-                    String::from("tcp:host=localhost,port=1234"),
-                ]),
+                listen: Some(
+                    Address::from_str("tcp:host=localhost,port=1234")
+                        .expect("should parse address")
+                ),
                 policies: vec![
                     Policy::DefaultContext(vec![
                         (
diff --git a/tests/config.rs b/tests/config.rs
index 54e965e..06d3071 100644
--- a/tests/config.rs
+++ b/tests/config.rs
@@ -1,10 +1,10 @@
-use std::{collections::HashSet, path::PathBuf};
+use std::{path::PathBuf, str::FromStr};
 
 use busd::config::{
     Access, BusType, Config, ConnectOperation, MessageType, Name, Operation, OwnOperation, Policy,
     ReceiveOperation, SendOperation,
 };
-use zbus::AuthMechanism;
+use zbus::{Address, AuthMechanism};
 
 #[test]
 fn config_read_file_with_includes_ok() {
@@ -15,13 +15,7 @@ fn config_read_file_with_includes_ok() {
         got,
         Config {
             auth: Some(AuthMechanism::External),
-            listen: HashSet::from_iter(vec![
-                String::from("unix:path=/tmp/a"), // via <includedir>
-                String::from("unix:path=/tmp/b"), // via <includedir>
-                // should be no "unix:path=/tmp/not_included" as that file ends in .xml
-                String::from("unix:path=/tmp/foo"),
-                String::from("tcp:host=localhost,port=1234"), // via <include>
-            ]),
+            listen: Some(Address::from_str("unix:path=/tmp/b").expect("should parse address")),
             policies: vec![
                 Policy::DefaultContext(vec![
                     (
@@ -127,7 +121,9 @@ fn config_read_file_session_conf_ok() {
     assert_eq!(
         got,
         Config {
-            listen: HashSet::from_iter(vec![String::from("@DBUS_SESSION_BUS_LISTEN_ADDRESS@"),]),
+            listen: Some(
+                Address::from_str("unix:path=/run/user/1000/bus").expect("should parse address")
+            ),
             keep_umask: true,
             policies: vec![Policy::DefaultContext(vec![
                 (
@@ -162,7 +158,10 @@ fn config_read_file_system_conf_ok() {
     let want = Config {
         auth: Some(AuthMechanism::External),
         fork: true,
-        listen: HashSet::from_iter(vec![String::from("@DBUS_SYSTEM_BUS_DEFAULT_ADDRESS@")]),
+        listen: Some(
+            Address::from_str("unix:path=/var/run/dbus/system_bus_socket")
+                .expect("should parse address"),
+        ),
         pidfile: Some(PathBuf::from("@DBUS_SYSTEM_PID_FILE@")),
         policies: vec![
             Policy::DefaultContext(vec![
diff --git a/tests/fixtures/session.conf b/tests/fixtures/session.conf
index 9f3e553..aa4ddf9 100644
--- a/tests/fixtures/session.conf
+++ b/tests/fixtures/session.conf
@@ -15,7 +15,7 @@
        the behavior of child processes. -->
   <keep_umask/>
 
-  <listen>@DBUS_SESSION_BUS_LISTEN_ADDRESS@</listen>
+  <listen>unix:path=/run/user/1000/bus</listen>
 
   <!-- On Unix systems, the most secure authentication mechanism is
   EXTERNAL, which uses credential-passing over Unix sockets.
diff --git a/tests/fixtures/system.conf b/tests/fixtures/system.conf
index 043b57c..a68b8fb 100644
--- a/tests/fixtures/system.conf
+++ b/tests/fixtures/system.conf
@@ -42,7 +42,7 @@
        means use abstract namespace, don't really create filesystem 
        file; only Linux supports this. Use path=/whatever on other 
        systems.) -->
-  <listen>@DBUS_SYSTEM_BUS_DEFAULT_ADDRESS@</listen>
+  <listen>unix:path=/var/run/dbus/system_bus_socket</listen>
 
   <policy context="default">
     <!-- All users can connect to system bus -->