diff --git a/debian/changelog b/debian/changelog
index 7cf45af1..8d7189b4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ostree (2018.6-4) UNRELEASED; urgency=medium
+
+  * Use upstream default ${libexecdir} now that Debian Policy allows
+    /usr/libexec (via FHS 3.0)
+
+ -- Simon McVittie <smcv@debian.org>  Wed, 04 Jul 2018 13:37:44 +0100
+
 ostree (2018.6-3) unstable; urgency=medium
 
   * d/p/avahi-Fail-immediately-if-we-can-t-talk-to-D-Bus-or-Avahi.patch:
diff --git a/debian/ostree-boot.install b/debian/ostree-boot.install
index 045b7383..195e5d1d 100644
--- a/debian/ostree-boot.install
+++ b/debian/ostree-boot.install
@@ -5,7 +5,7 @@ lib/systemd/system/ostree-finalize-staged.service
 lib/systemd/system/ostree-prepare-root.service
 lib/systemd/system/ostree-remount.service
 usr/lib/dracut/modules.d/98ostree
-usr/lib/libostree/grub2-15_ostree
 usr/lib/ostree/ostree-prepare-root
 usr/lib/ostree/ostree-remount
 usr/lib/tmpfiles.d/ostree-tmpfiles.conf
+usr/libexec/libostree/grub2-15_ostree
diff --git a/debian/ostree-tests.install b/debian/ostree-tests.install
index 47ef1484..5ccecb31 100644
--- a/debian/ostree-tests.install
+++ b/debian/ostree-tests.install
@@ -1,3 +1,3 @@
-usr/lib/installed-tests/libostree
-usr/lib/libostree/ostree-trivial-httpd
+usr/libexec/installed-tests/libostree
+usr/libexec/libostree/ostree-trivial-httpd
 usr/share/installed-tests/libostree
diff --git a/debian/ostree-tests.lintian-overrides b/debian/ostree-tests.lintian-overrides
index d5652880..87efd11d 100644
--- a/debian/ostree-tests.lintian-overrides
+++ b/debian/ostree-tests.lintian-overrides
@@ -1,14 +1,14 @@
 # This is deliberate: it's just some random signed file to be verified, and
 # upstream happens to have used the text of the LGPL as the signed file
-ostree-tests: extra-license-file usr/lib/installed-tests/libostree/gpg-verify-data/lgpl2
-ostree-tests: extra-license-file usr/lib/installed-tests/libostree/gpg-verify-data/lgpl2.sig
+ostree-tests: extra-license-file usr/libexec/installed-tests/libostree/gpg-verify-data/lgpl2
+ostree-tests: extra-license-file usr/libexec/installed-tests/libostree/gpg-verify-data/lgpl2.sig
 
 # This is deliberate, working around the assumption of recursive make
-ostree-tests: symlink-is-self-recursive usr/lib/installed-tests/libostree/tests .
+ostree-tests: symlink-is-self-recursive usr/libexec/installed-tests/libostree/tests .
 
 # We won't run this on sparc64 currently
-[sparc64]: missing-dep-for-interpreter gjs => gjs (usr/lib/installed-tests/libostree/corrupt-repo-ref.js)
+[sparc64]: missing-dep-for-interpreter gjs => gjs (usr/libexec/installed-tests/libostree/corrupt-repo-ref.js)
 
 # This shared object genuinely doesn't use any libc ABIs directly,
 # only via GLib
-library-not-linked-against-libc usr/lib/installed-tests/libostree/libreaddir-rand.so
+library-not-linked-against-libc usr/libexec/installed-tests/libostree/libreaddir-rand.so
diff --git a/debian/rules b/debian/rules
index 3f92293f..8012df44 100755
--- a/debian/rules
+++ b/debian/rules
@@ -66,7 +66,7 @@ endif
 
 override_dh_install:
 	rm -f debian/tmp/usr/lib/*/*.la
-	rm -f debian/tmp/usr/lib/installed-tests/libostree/*.la
+	rm -f debian/tmp/usr/libexec/installed-tests/libostree/*.la
 	:
 	# TODO: when someone documents how to test these (#824649) they
 	# should be installed in a new ostree-boot package: see
@@ -78,7 +78,7 @@ override_dh_install:
 	rm -f debian/tmp/lib/systemd/system/ostree-prepare-root.service
 	rm -f debian/tmp/lib/systemd/system/ostree-remount.service
 	rm -fr debian/tmp/usr/lib/dracut/modules.d/98ostree/
-	rm -f debian/tmp/usr/lib/libostree/grub2-15_ostree
+	rm -f debian/tmp/usr/libexec/libostree/grub2-15_ostree
 	rm -f debian/tmp/usr/lib/ostree/ostree-prepare-root
 	rm -f debian/tmp/usr/lib/ostree/ostree-remount
 	rm -f debian/tmp/usr/lib/tmpfiles.d/ostree-tmpfiles.conf