diff --git a/debian/changelog b/debian/changelog
index f81ad251..0944e4d6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,5 +1,7 @@
 ostree (2018.7-1) UNRELEASED; urgency=medium
 
+  * Use upstream default ${libexecdir} now that Debian Policy allows
+    /usr/libexec (via FHS 3.0)
   * Standards-Version: 4.1.5 (no changes required)
   * New upstream release
     - d/libostree-1-1.symbols: Update
diff --git a/debian/ostree-boot.install b/debian/ostree-boot.install
index 045b7383..195e5d1d 100644
--- a/debian/ostree-boot.install
+++ b/debian/ostree-boot.install
@@ -5,7 +5,7 @@ lib/systemd/system/ostree-finalize-staged.service
 lib/systemd/system/ostree-prepare-root.service
 lib/systemd/system/ostree-remount.service
 usr/lib/dracut/modules.d/98ostree
-usr/lib/libostree/grub2-15_ostree
 usr/lib/ostree/ostree-prepare-root
 usr/lib/ostree/ostree-remount
 usr/lib/tmpfiles.d/ostree-tmpfiles.conf
+usr/libexec/libostree/grub2-15_ostree
diff --git a/debian/ostree-tests.install b/debian/ostree-tests.install
index 47ef1484..5ccecb31 100644
--- a/debian/ostree-tests.install
+++ b/debian/ostree-tests.install
@@ -1,3 +1,3 @@
-usr/lib/installed-tests/libostree
-usr/lib/libostree/ostree-trivial-httpd
+usr/libexec/installed-tests/libostree
+usr/libexec/libostree/ostree-trivial-httpd
 usr/share/installed-tests/libostree
diff --git a/debian/ostree-tests.lintian-overrides b/debian/ostree-tests.lintian-overrides
index d5652880..87efd11d 100644
--- a/debian/ostree-tests.lintian-overrides
+++ b/debian/ostree-tests.lintian-overrides
@@ -1,14 +1,14 @@
 # This is deliberate: it's just some random signed file to be verified, and
 # upstream happens to have used the text of the LGPL as the signed file
-ostree-tests: extra-license-file usr/lib/installed-tests/libostree/gpg-verify-data/lgpl2
-ostree-tests: extra-license-file usr/lib/installed-tests/libostree/gpg-verify-data/lgpl2.sig
+ostree-tests: extra-license-file usr/libexec/installed-tests/libostree/gpg-verify-data/lgpl2
+ostree-tests: extra-license-file usr/libexec/installed-tests/libostree/gpg-verify-data/lgpl2.sig
 
 # This is deliberate, working around the assumption of recursive make
-ostree-tests: symlink-is-self-recursive usr/lib/installed-tests/libostree/tests .
+ostree-tests: symlink-is-self-recursive usr/libexec/installed-tests/libostree/tests .
 
 # We won't run this on sparc64 currently
-[sparc64]: missing-dep-for-interpreter gjs => gjs (usr/lib/installed-tests/libostree/corrupt-repo-ref.js)
+[sparc64]: missing-dep-for-interpreter gjs => gjs (usr/libexec/installed-tests/libostree/corrupt-repo-ref.js)
 
 # This shared object genuinely doesn't use any libc ABIs directly,
 # only via GLib
-library-not-linked-against-libc usr/lib/installed-tests/libostree/libreaddir-rand.so
+library-not-linked-against-libc usr/libexec/installed-tests/libostree/libreaddir-rand.so
diff --git a/debian/rules b/debian/rules
index 3f92293f..223050d0 100755
--- a/debian/rules
+++ b/debian/rules
@@ -14,7 +14,7 @@ override_dh_autoreconf:
 configure_options = \
 	GJS=some-nonexistent-gjs-binary \
 	--enable-installed-tests \
-	--libexecdir='$${prefix}/lib' \
+	--libexecdir='$${prefix}/libexec' \
 	--with-avahi \
 	--with-dracut \
 	--with-grub2 \
@@ -66,7 +66,7 @@ endif
 
 override_dh_install:
 	rm -f debian/tmp/usr/lib/*/*.la
-	rm -f debian/tmp/usr/lib/installed-tests/libostree/*.la
+	rm -f debian/tmp/usr/libexec/installed-tests/libostree/*.la
 	:
 	# TODO: when someone documents how to test these (#824649) they
 	# should be installed in a new ostree-boot package: see
@@ -78,7 +78,7 @@ override_dh_install:
 	rm -f debian/tmp/lib/systemd/system/ostree-prepare-root.service
 	rm -f debian/tmp/lib/systemd/system/ostree-remount.service
 	rm -fr debian/tmp/usr/lib/dracut/modules.d/98ostree/
-	rm -f debian/tmp/usr/lib/libostree/grub2-15_ostree
+	rm -f debian/tmp/usr/libexec/libostree/grub2-15_ostree
 	rm -f debian/tmp/usr/lib/ostree/ostree-prepare-root
 	rm -f debian/tmp/usr/lib/ostree/ostree-remount
 	rm -f debian/tmp/usr/lib/tmpfiles.d/ostree-tmpfiles.conf