NTPD and the Terrible, Horrible, No Good, Very Bad Listening Sockets

Trying to get ntpd to stop creating listening sockets is a royal pain in the ass. Sure, I can set a firewall rule that blocks access to the port on undesired interfaces, but it's more work to make that happen, and it's just not as clean. Here's what I finally ended up doing to stop creating default (0.0.0.0:123 for IPv4 and :::123 for IPv6) listeners and just set a listening socket on one address on my internal interface. Hopefully it helps someone else out.
 # Add to ntp.conf, in order
 interface ignore all
 interface ignore ipv4
 interface ignore ipv6
 interface listen 192.168.0.1

While there’s not a gaping security window with NTP, I just feel a little safer not having anything listening at all.