diff --git a/debian/changelog b/debian/changelog
index 4eebe51ff..bf97194e2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -37,6 +37,8 @@ freeipa (4.6.2-1) UNRELEASED; urgency=medium
   * control: Bump dependency on bind9 and bind9-dyndb-ldap.
   * control: add libapache2-mod-lookup-identity to server dependencies,
     enable/disable it in postinst/postrm.
+  * control: Depend on newer custodia, move dep on python-custodia to
+    python-ipaserver.
 
  -- Timo Aaltonen <tjaalton@debian.org>  Tue, 14 Mar 2017 16:55:45 +0200
 
diff --git a/debian/control b/debian/control
index 1dcef087c..8ca924db8 100644
--- a/debian/control
+++ b/debian/control
@@ -74,7 +74,7 @@ Depends:
  acl,
  apache2,
  certmonger (>= 0.78.6-3),
- custodia,
+ custodia (>= 0.5.0),
  fonts-font-awesome,
  fonts-open-sans,
  freeipa-admintools (= ${source:Version}),
@@ -281,7 +281,6 @@ Depends:
  keyutils,
  python-cffi,
  python-cryptography,
- python-custodia,
  python-dbus,
  python-dnspython,
  python-gssapi,
@@ -320,6 +319,7 @@ Replaces: freeipa-server (<< 4.3.0-1),
 Depends:
  freeipa-common (= ${binary:Version}),
  pki-tools (>= 10.2.6-3),
+ python-custodia (>= 0.5.0),
  python-dbus,
  python-dnspython,
  python-gssapi,