diff --git a/debian/changelog b/debian/changelog
index e547bd1fc..1bb196b65 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -44,6 +44,8 @@ freeipa (4.3.0-1) UNRELEASED; urgency=medium
   * fix-kdcproxy-paths.diff: Fix paths in kdcproxy configs.
   * add-debian-platform.diff: Update paths.py to include all variables,
     comment out ones we don't modify.
+  * rules, server.install: Install scripts under /usr/lib instead of
+    multiarch path to avoid hacking the code too much.
 
  -- Timo Aaltonen <tjaalton@debian.org>  Sat, 03 Oct 2015 08:56:31 +0300
 
diff --git a/debian/freeipa-server-trust-ad.install b/debian/freeipa-server-trust-ad.install
index f844ea25d..09b659f95 100644
--- a/debian/freeipa-server-trust-ad.install
+++ b/debian/freeipa-server-trust-ad.install
@@ -3,8 +3,8 @@ etc/oddjobd.conf.d/oddjobd-ipa-trust.conf
 usr/lib/*/dirsrv/plugins/libipa_extdom_extop.so
 usr/lib/*/dirsrv/plugins/libipa_sidgen.so
 usr/lib/*/dirsrv/plugins/libipa_sidgen_task.so
-usr/lib/*/ipa/oddjob/com.redhat.idm.trust-fetch-domains
 usr/lib/*/samba/pdb/ipasam.so
+usr/lib/ipa/oddjob/com.redhat.idm.trust-fetch-domains
 usr/sbin/ipa-adtrust-install
 usr/share/ipa/smb.conf.empty
 usr/share/man/man1/ipa-adtrust-install.1*
diff --git a/debian/freeipa-server.install b/debian/freeipa-server.install
index 9b1493616..7e6e58607 100644
--- a/debian/freeipa-server.install
+++ b/debian/freeipa-server.install
@@ -4,8 +4,6 @@ etc/ipa/kdcproxy
 etc/dbus-1/system.d/org.freeipa.server.conf
 etc/oddjobd.conf.d/ipa-server.conf
 lib/systemd/system/*
-usr/lib/*/certmonger/dogtag-ipa-ca-renew-agent-submit
-usr/lib/*/certmonger/ipa-server-guard
 usr/lib/*/dirsrv/plugins/libipa_cldap.so
 usr/lib/*/dirsrv/plugins/libipa_dns.so
 usr/lib/*/dirsrv/plugins/libipa_enrollment_extop.so
@@ -20,10 +18,13 @@ usr/lib/*/dirsrv/plugins/libipa_uuid.so
 usr/lib/*/dirsrv/plugins/libipa_winsync.so
 usr/lib/*/dirsrv/plugins/libtopology.so
 usr/lib/*/ipa-otpd
-usr/lib/*/ipa/ipa-httpd-kdcproxy
-usr/lib/*/ipa/certmonger/*
-usr/lib/*/ipa/oddjob/org.freeipa.server.conncheck
 usr/lib/*/krb5/plugins/kdb/*.so
+usr/lib/certmonger/dogtag-ipa-ca-renew-agent-submit
+usr/lib/certmonger/ipa-server-guard
+usr/lib/ipa/certmonger/*
+usr/lib/ipa/generate-rndc-key.sh
+usr/lib/ipa/ipa-httpd-kdcproxy
+usr/lib/ipa/oddjob/org.freeipa.server.conncheck
 usr/sbin/ipa-advise
 usr/sbin/ipa-backup
 usr/sbin/ipa-ca-install
@@ -52,7 +53,6 @@ usr/share/ipa/*.uldif
 usr/share/ipa/advise/legacy/*.template
 usr/share/ipa/copy-schema-to-ca.py
 usr/share/ipa/ffextension/*
-usr/share/ipa/generate-rndc-key.sh
 usr/share/ipa/html/*
 usr/share/ipa/ipa-pki-proxy.conf
 usr/share/ipa/ipa-rewrite.conf
diff --git a/debian/rules b/debian/rules
index 6a5b820e4..d463e59af 100755
--- a/debian/rules
+++ b/debian/rules
@@ -37,10 +37,12 @@ override_dh_auto_configure:
 	dh_auto_configure -Dipa-client
 ifneq ($(ONLY_CLIENT), 1)
 	dh_auto_configure -Ddaemons -- \
+		--libexecdir=/usr/lib \
 		--with-openldap \
 		--with-systemdsystemunitdir=/lib/systemd/system
 
-	dh_auto_configure -Dinstall
+	dh_auto_configure -Dinstall -- \
+		--libexecdir=/usr/lib
 endif
 
 override_dh_auto_build:
@@ -61,6 +63,7 @@ ifneq ($(ONLY_CLIENT), 1)
 	make $(PLATFORM) IPA_VERSION_IS_GIT_SNAPSHOT=no install DESTDIR=$(DESTDIR)
 	cd ..
 
+	mv $(DESTDIR)/usr/lib/$(DEB_HOST_MULTIARCH)/ipa/certmonger $(DESTDIR)/usr/lib/ipa
 	chmod 755 $(DESTDIR)/usr/lib/*/ipa/certmonger/*
 
 	mkdir -p $(DESTDIR)/usr/share/bash-completion/completions \
@@ -81,11 +84,11 @@ ifneq ($(ONLY_CLIENT), 1)
 	install -m 0644 init/systemd/ipa.service $(DESTDIR)/lib/systemd/system
 	install -m 0644 init/systemd/ipa-custodia.service $(DESTDIR)/lib/systemd/system
 	install -m 0644 contrib/completion/ipa.bash_completion $(DESTDIR)/usr/share/bash-completion/completions/ipa
-	install -m 0755 debian/generate-rndc-key.sh $(DESTDIR)/usr/share/ipa
+	install -m 0755 debian/generate-rndc-key.sh $(DESTDIR)/usr/lib/ipa
 
 	for i in $(DESTDIR)/etc/oddjobd.conf.d/ipa-server.conf \
 		$(DESTDIR)/etc/oddjobd.conf.d/oddjobd-ipa-trust.conf; do \
-		sed -i -e"s/libexec.*\//lib\/$(DEB_HOST_MULTIARCH)\/ipa\/oddjob\//" $$i ; \
+		sed -i -e"s/libexec.*\//lib\/ipa\/oddjob\//" $$i ; \
 	done
 else
 	make $(PLATFORM) IPA_VERSION_IS_GIT_SNAPSHOT=no client-install DESTDIR=$(DESTDIR)