diff --git a/debian/changelog b/debian/changelog
index bbb40e8..d5bdc80 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -7,6 +7,9 @@ xen-tools (4.8.1~dev-1) UNRELEASED; urgency=medium
       release (bookwork → bookworm).
     + Actually install xen-resize-guest tool. (Thanks lintian for the
       spare-manual-page warning!)
+    + Distinguish between those Debian releases using $dist/updates for
+      security updates and those who use $dist-security. Thanks Paul Wise!
+      (Closes: #972749)
 
   * Recommend deboootstrap ≥ 1.0.110~ for working bootstrapping of Ubuntu
     6.06 Dapper and 6.10 Edgy (see #659360) and for support of Ubuntu
diff --git a/etc/distributions.conf b/etc/distributions.conf
index 07bddce..4628b63 100644
--- a/etc/distributions.conf
+++ b/etc/distributions.conf
@@ -5,17 +5,17 @@
 # codename = distribution and further keywords
 #
 # Known distributions: debian, ubuntu
-# Known keywords: eol, pygrub, default-keyring, dont-test
+# Known keywords: eol, pygrub, default-keyring, dont-test, security-subdir
 # Known generic keywords: *.gpg (uses the according /usr/share/keyrings/….gpg file)
 #
-sarge        = debian eol
-etch         = debian eol
-lenny        = debian eol
-squeeze      = debian eol default-keyring
-wheezy       = debian eol
-jessie       = debian eol
-stretch      = debian
-buster       = debian
+sarge        = debian security-subdir eol
+etch         = debian security-subdir eol
+lenny        = debian security-subdir eol
+squeeze      = debian security-subdir eol default-keyring
+wheezy       = debian security-subdir eol
+jessie       = debian security-subdir eol
+stretch      = debian security-subdir
+buster       = debian security-subdir
 bullseye     = debian
 bookworm     = debian dont-test
 trixie       = debian dont-test
diff --git a/hooks/common.sh b/hooks/common.sh
index a1b441b..b5fc417 100755
--- a/hooks/common.sh
+++ b/hooks/common.sh
@@ -422,3 +422,24 @@ installGentooPackage ()
     logMessage "NOTE: Not doing anything - this is a stub - FIXME"
 
 }
+
+
+
+
+#
+#  findDistributionConf path
+#
+# returns either a relative or an absolut path to distributions.conf
+#
+findDistributionsConf ()
+{
+    prefix=$1
+
+    if [ -f etc/distributions.conf ]; then
+        echo etc/distributions.conf
+    elif [ -f ${prefix:-}/etc/xen-tools/distributions.conf ]; then
+        echo ${prefix:-}/etc/xen-tools/distributions.conf
+    elif [ -f /etc/xen-tools/distributions.conf ]; then
+        echo /etc/xen-tools/distributions.conf
+    fi
+}
diff --git a/hooks/debian/20-setup-apt b/hooks/debian/20-setup-apt
index 464d4f1..fef5df9 100755
--- a/hooks/debian/20-setup-apt
+++ b/hooks/debian/20-setup-apt
@@ -20,6 +20,7 @@ else
     . ./hooks/common.sh
 fi
 
+distributions_conf=$(findDistributionsConf $prefix)
 
 #
 # Log our start
@@ -66,7 +67,9 @@ if ( test "${dist}" "!=" "sid" && test "${dist}" "!=" "unstable" && \
      test -e /etc/apt/sources.list && \
      grep ^deb.*security -r /etc/apt/sources.list /etc/apt/sources.list.d >/dev/null 2>/dev/null ) ; then
 
-    cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
+    if fgrep "${dist}" $distributions_conf | fgrep -q security-subdir; then
+
+        cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
 # 
 #  Security updates
 # 
@@ -74,13 +77,25 @@ deb     http://security.debian.org/ ${dist}/updates  main contrib non-free
 deb-src http://security.debian.org/ ${dist}/updates  main contrib non-free
 E_O_APT
 
+    else
+
+        cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
+# 
+#  Security updates
+# 
+deb     http://security.debian.org/ ${dist}-security  main contrib non-free
+deb-src http://security.debian.org/ ${dist}-security  main contrib non-free
+E_O_APT
+
+    fi
+
 else
     cat <<E_O_APT >> ${prefix}/etc/apt/sources.list
 # 
 #  Security updates - Uncomment to enable.
 # 
-# deb     http://security.debian.org/ ${dist}/updates  main contrib non-free
-# deb-src http://security.debian.org/ ${dist}/updates  main contrib non-free
+# deb     http://security.debian.org/ ${dist}-security  main contrib non-free
+# deb-src http://security.debian.org/ ${dist}-security  main contrib non-free
 E_O_APT
 
 fi