diff --git a/distro/pkg/deb/control b/distro/pkg/deb/control
index ae59ec5dd22f60c8e6cae636dd277d807f386070..4f938f2c74b3432ea3fbfa816313c0a22e5f680f 100644
--- a/distro/pkg/deb/control
+++ b/distro/pkg/deb/control
@@ -161,6 +161,28 @@ Description: DNS clients provided with Knot DNS (kdig, knsupdate)
  .
  WARNING: knslookup is not provided as it is considered obsolete.
 
+Package: knot-dnssecutils
+Architecture: any
+Depends:
+ libdnssec8 (= ${binary:Version}),
+ libknot12 (= ${binary:Version}),
+ libzscanner4 (= ${binary:Version}),
+ ${misc:Depends},
+ ${shlibs:Depends},
+Description: DNSSEC tools provided with Knot DNS
+ Knot DNS is a fast, authoritative only, high performance, feature
+ full and open source name server.
+ .
+ Knot DNS is developed by CZ.NIC Labs, the R&D department of .CZ
+ registry and hence is well suited to run anything from the root
+ zone, the top-level domain, to many smaller standard domain names.
+ .
+ This package delivers various DNSSEC tools from Knot DNS.
+ .
+  - kzonecheck
+  - kzonesign
+  - knsec3hash
+
 Package: knot-host
 Architecture: any
 Depends:
diff --git a/distro/pkg/deb/knot-dnssecutils.install b/distro/pkg/deb/knot-dnssecutils.install
new file mode 100644
index 0000000000000000000000000000000000000000..20009e8865cecc027f6b6511550bcfcb48cee367
--- /dev/null
+++ b/distro/pkg/deb/knot-dnssecutils.install
@@ -0,0 +1,3 @@
+usr/bin/knsec3hash
+usr/bin/kzonecheck
+usr/bin/kzonesign
diff --git a/distro/pkg/deb/knot-dnssecutils.manpages b/distro/pkg/deb/knot-dnssecutils.manpages
new file mode 100644
index 0000000000000000000000000000000000000000..913c4cb5a81a212574b56bed8ad01d5ccdae4493
--- /dev/null
+++ b/distro/pkg/deb/knot-dnssecutils.manpages
@@ -0,0 +1,3 @@
+usr/share/man/man1/knsec3hash.1
+usr/share/man/man1/kzonecheck.1
+usr/share/man/man1/kzonesign.1
diff --git a/distro/pkg/deb/knot.install b/distro/pkg/deb/knot.install
index f67c3e98112c53d1f49c29dd45f325cf6c3fef45..94c3999a371fd23d77ce7a21e5539c836704eebd 100644
--- a/distro/pkg/deb/knot.install
+++ b/distro/pkg/deb/knot.install
@@ -1,9 +1,6 @@
 debian/cz.nic.knotd.conf etc/dbus-1/system.d/
 debian/ufw/knot etc/ufw/applications.d/
 etc/knot/knot.conf
-usr/bin/knsec3hash
-usr/bin/kzonecheck
-usr/bin/kzonesign
 usr/sbin/kcatalogprint
 usr/sbin/keymgr
 usr/sbin/kjournalprint
diff --git a/distro/pkg/deb/knot.manpages b/distro/pkg/deb/knot.manpages
index 8244621233a164d2e6788d5e2dafa464fce0470d..5d23e9f08e7ab714ccb4f49e6ded9e3d9b5ffe96 100644
--- a/distro/pkg/deb/knot.manpages
+++ b/distro/pkg/deb/knot.manpages
@@ -1,6 +1,3 @@
-usr/share/man/man1/knsec3hash.1
-usr/share/man/man1/kzonecheck.1
-usr/share/man/man1/kzonesign.1
 usr/share/man/man5/knot.conf.5
 usr/share/man/man8/kcatalogprint.8
 usr/share/man/man8/keymgr.8
diff --git a/distro/pkg/rpm/knot.spec b/distro/pkg/rpm/knot.spec
index 98ed69399173e61b9c50c38b1748ad14f04f4f92..33d0af6548e0e8478904e497fb4d48307cd3eb64 100644
--- a/distro/pkg/rpm/knot.spec
+++ b/distro/pkg/rpm/knot.spec
@@ -110,10 +110,19 @@ included in knot-libs package.
 %package utils
 Summary:	DNS client utilities shipped with the Knot DNS server
 Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
+# Debian package compat
+Provides:	%{name}-dnsutils = %{version}-%{release}
 
 %description utils
 The package contains DNS client utilities shipped with the Knot DNS server.
 
+%package dnssecutils
+Summary:	DNSSEC tools shipped with the Knot DNS server
+Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
+
+%description dnssecutils
+The package contains DNSSEC tools shipped with the Knot DNS server.
+
 %package module-dnstap
 Summary:	dnstap module for Knot DNS
 Requires:	%{name} = %{version}-%{release}
@@ -257,8 +266,6 @@ getent passwd knot >/dev/null || \
 %dir %{_libdir}/knot
 %dir %{_libdir}/knot/modules-*
 %{_unitdir}/knot.service
-%{_bindir}/kzonecheck
-%{_bindir}/kzonesign
 %{_sbindir}/kcatalogprint
 %{_sbindir}/kjournalprint
 %{_sbindir}/keymgr
@@ -267,8 +274,6 @@ getent passwd knot >/dev/null || \
 %if 0%{?suse_version}
 %{_sbindir}/rcknot
 %endif
-%{_mandir}/man1/kzonecheck.*
-%{_mandir}/man1/kzonesign.*
 %{_mandir}/man5/knot.conf.*
 %{_mandir}/man8/kcatalogprint.*
 %{_mandir}/man8/kjournalprint.*
@@ -280,7 +285,6 @@ getent passwd knot >/dev/null || \
 %files utils
 %{_bindir}/kdig
 %{_bindir}/khost
-%{_bindir}/knsec3hash
 %{_bindir}/knsupdate
 %if 0%{?use_xdp}
 %{_sbindir}/kxdpgun
@@ -288,9 +292,16 @@ getent passwd knot >/dev/null || \
 %endif
 %{_mandir}/man1/kdig.*
 %{_mandir}/man1/khost.*
-%{_mandir}/man1/knsec3hash.*
 %{_mandir}/man1/knsupdate.*
 
+%files dnssecutils
+%{_bindir}/knsec3hash
+%{_bindir}/kzonecheck
+%{_bindir}/kzonesign
+%{_mandir}/man1/knsec3hash.*
+%{_mandir}/man1/kzonecheck.*
+%{_mandir}/man1/kzonesign.*
+
 %files module-dnstap
 %{_libdir}/knot/modules-*/dnstap.so