diff --git a/.gitignore b/.gitignore
index fe7ad126729e2bb54fb38adad4e42344ca5bf2c3..1cf064b28c4fe7af62be39df78e56dc55834d427 100644
--- a/.gitignore
+++ b/.gitignore
@@ -74,15 +74,16 @@
 /src/zscanner/version.h
 
 # Binaries
-/src/knotc
-/src/knotd
-/src/knot1to2
 /src/kdig
+/src/keymgr
 /src/khost
-/src/knsupdate
+/src/knot1to2
+/src/knotc
+/src/knotd
 /src/knsec3hash
-/src/rosedb_tool
+/src/knsupdate
 /src/kzonecheck
+/src/rosedb_tool
 
 # Plugin binaries
 /src/rosedb_tool
diff --git a/Knot.files b/Knot.files
index ff8f9fa6cd3dca878d860571b6795c55754b116a..5562463f41daed35d8c2c30034e91b8550265d2c 100644
--- a/Knot.files
+++ b/Knot.files
@@ -155,6 +155,7 @@ src/dnssec/shared/path.c
 src/dnssec/shared/path.h
 src/dnssec/shared/pem.c
 src/dnssec/shared/pem.h
+src/dnssec/shared/print.h
 src/dnssec/shared/shared.h
 src/dnssec/shared/strtonum.h
 src/dnssec/shared/timestamp.c
@@ -189,22 +190,6 @@ src/dnssec/tests/shared_wire.c
 src/dnssec/tests/sign.c
 src/dnssec/tests/sign_der.c
 src/dnssec/tests/tsig.c
-src/dnssec/utils/cmdparse/command.c
-src/dnssec/utils/cmdparse/command.h
-src/dnssec/utils/cmdparse/match.h
-src/dnssec/utils/cmdparse/parameter.c
-src/dnssec/utils/cmdparse/parameter.h
-src/dnssec/utils/cmdparse/value.c
-src/dnssec/utils/cmdparse/value.h
-src/dnssec/utils/keymgr.c
-src/dnssec/utils/knsec3hash.c
-src/dnssec/utils/legacy/key.c
-src/dnssec/utils/legacy/key.h
-src/dnssec/utils/legacy/privkey.c
-src/dnssec/utils/legacy/privkey.h
-src/dnssec/utils/legacy/pubkey.c
-src/dnssec/utils/legacy/pubkey.h
-src/dnssec/utils/print.h
 src/knot/common/evsched.c
 src/knot/common/evsched.h
 src/knot/common/fdset.c
@@ -452,6 +437,20 @@ src/utils/kdig/kdig_exec.h
 src/utils/kdig/kdig_main.c
 src/utils/kdig/kdig_params.c
 src/utils/kdig/kdig_params.h
+src/utils/keymgr/cmdparse/command.c
+src/utils/keymgr/cmdparse/command.h
+src/utils/keymgr/cmdparse/match.h
+src/utils/keymgr/cmdparse/parameter.c
+src/utils/keymgr/cmdparse/parameter.h
+src/utils/keymgr/cmdparse/value.c
+src/utils/keymgr/cmdparse/value.h
+src/utils/keymgr/keymgr.c
+src/utils/keymgr/legacy/key.c
+src/utils/keymgr/legacy/key.h
+src/utils/keymgr/legacy/privkey.c
+src/utils/keymgr/legacy/privkey.h
+src/utils/keymgr/legacy/pubkey.c
+src/utils/keymgr/legacy/pubkey.h
 src/utils/khost/khost_main.c
 src/utils/khost/khost_params.c
 src/utils/khost/khost_params.h
@@ -476,6 +475,7 @@ src/utils/knotc/main.c
 src/utils/knotc/process.c
 src/utils/knotc/process.h
 src/utils/knotd/main.c
+src/utils/knsec3hash/knsec3hash.c
 src/utils/knsupdate/knsupdate_exec.c
 src/utils/knsupdate/knsupdate_exec.h
 src/utils/knsupdate/knsupdate_main.c
diff --git a/configure.ac b/configure.ac
index 388557862fa6849b401e6a6427a2dc1ac59bd1ff..12b286519a08df063079d0e1a8244dd14add5c96 100644
--- a/configure.ac
+++ b/configure.ac
@@ -556,7 +556,6 @@ AC_CONFIG_FILES([Makefile
                  src/contrib/dnstap/Makefile
                  src/dnssec/Makefile
                  src/dnssec/tests/Makefile
-                 src/dnssec/utils/Makefile
                  src/zscanner/Makefile
                  ])
 
diff --git a/src/Makefile.am b/src/Makefile.am
index 7ec3e81d6764a694e94b1f410d2cc13fc5973b13..7d40b8e4e4675d610cd02ec1e5c802a5c0a9a965 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -224,7 +224,7 @@ libknotus_la_LIBADD = libcontrib.la libknot.la
 
 if HAVE_DAEMON
 
-sbin_PROGRAMS = knotc knotd kzonecheck
+sbin_PROGRAMS = keymgr knotc knotd kzonecheck
 libexec_PROGRAMS = knot1to2
 noinst_LTLIBRARIES += libknotd.la libknotus.la
 
@@ -232,6 +232,22 @@ EXTRA_DIST += 					\
 	utils/knot1to2/cf-lex.l			\
 	utils/knot1to2/cf-parse.y
 
+keymgr_SOURCES =				\
+	utils/keymgr/cmdparse/command.c		\
+	utils/keymgr/cmdparse/command.h		\
+	utils/keymgr/cmdparse/match.h		\
+	utils/keymgr/cmdparse/parameter.c	\
+	utils/keymgr/cmdparse/parameter.h	\
+	utils/keymgr/cmdparse/value.c		\
+	utils/keymgr/cmdparse/value.h		\
+	utils/keymgr/legacy/key.c		\
+	utils/keymgr/legacy/key.h		\
+	utils/keymgr/legacy/privkey.c		\
+	utils/keymgr/legacy/privkey.h		\
+	utils/keymgr/legacy/pubkey.c		\
+	utils/keymgr/legacy/pubkey.h		\
+	utils/keymgr/keymgr.c
+
 knotc_SOURCES =					\
 	utils/knotc/commands.c			\
 	utils/knotc/commands.h			\
@@ -257,6 +273,11 @@ knot1to2_SOURCES =				\
 	utils/knot1to2/main.c			\
 	utils/knot1to2/scheme.h
 
+kzonecheck_SOURCES =				\
+	utils/kzonecheck/main.c			\
+	utils/kzonecheck/zone_check.c		\
+	utils/kzonecheck/zone_check.h
+
 # static: server shared
 libknotd_la_SOURCES =				\
 	knot/conf/base.c			\
@@ -400,17 +421,13 @@ libknotd_la_CPPFLAGS  = $(AM_CPPFLAGS) $(systemd_CFLAGS) $(liburcu_CFLAGS)
 libknotd_la_LDFLAGS = $(AM_LDFLAGS) $(systemd_LIBS) $(liburcu_LIBS)
 libknotd_la_LIBADD = libknot.la libknot-yparser.la zscanner/libzscanner.la $(liburcu_LIBS)
 
+keymgr_CPPFLAGS = $(AM_CPPFLAGS) -I$(srcdir)/dnssec/lib/dnssec -I$(srcdir)/dnssec $(gnutls_CFLAGS)
+keymgr_LDADD = dnssec/libdnssec.la dnssec/libshared.la zscanner/libzscanner.la $(gnutls_LIBS)
 knotd_CPPFLAGS = $(AM_CPPFLAGS) $(liburcu_CFLAGS)
 knotd_LDADD = libknotd.la $(liburcu_LIBS)
 knotc_CPPFLAGS = $(AM_CPPFLAGS) $(libedit_CFLAGS)
 knotc_LDADD = libknotd.la libknotus.la $(libedit_LIBS)
 knot1to2_LDADD = libcontrib.la
-
-kzonecheck_SOURCES = \
-	utils/kzonecheck/main.c \
-	utils/kzonecheck/zone_check.c \
-	utils/kzonecheck/zone_check.h
-
 kzonecheck_LDADD = libknotd.la
 
 ####################################
@@ -445,7 +462,7 @@ endif # HAVE_DAEMON
 
 if HAVE_UTILS
 
-bin_PROGRAMS = kdig khost knsupdate
+bin_PROGRAMS = kdig khost knsec3hash knsupdate
 noinst_LTLIBRARIES += libknotus.la
 
 kdig_SOURCES =					\
@@ -464,6 +481,9 @@ khost_SOURCES =					\
 	utils/khost/khost_params.c		\
 	utils/khost/khost_params.h
 
+knsec3hash_SOURCES =				\
+	utils/knsec3hash/knsec3hash.c
+
 knsupdate_SOURCES =				\
 	utils/knsupdate/knsupdate_exec.c	\
 	utils/knsupdate/knsupdate_exec.h	\
@@ -475,6 +495,8 @@ knsupdate_SOURCES =				\
 kdig_LDADD       = $(libidn_LIBS) libknotus.la
 khost_LDADD      = $(libidn_LIBS) libknotus.la
 knsupdate_LDADD  = zscanner/libzscanner.la libknotus.la
+knsec3hash_CPPFLAGS = $(AM_CPPFLAGS) -I$(srcdir)/dnssec/lib/dnssec -I$(srcdir)/dnssec
+knsec3hash_LDADD = dnssec/libdnssec.la dnssec/libshared.la
 
 #######################################
 # Optional Knot DNS Utilities modules #
diff --git a/src/dnssec/Makefile.am b/src/dnssec/Makefile.am
index 8dd17aa03ddd4d7c70a40a67b7b2a5b3061e80d1..d5a9806f4717517b57da7ef61dd086a44d9c83ef 100644
--- a/src/dnssec/Makefile.am
+++ b/src/dnssec/Makefile.am
@@ -1,4 +1,4 @@
-SUBDIRS = . utils tests
+SUBDIRS = . tests
 
 .PHONY: check-compile
 check-compile:
diff --git a/src/dnssec/utils/print.h b/src/dnssec/shared/print.h
similarity index 92%
rename from src/dnssec/utils/print.h
rename to src/dnssec/shared/print.h
index 62ac0b6a2e788aaee0a78b26dbd1c5ee81e4ed1a..a0cb461071b1877f683864c7b3fafb427a22309e 100644
--- a/src/dnssec/utils/print.h
+++ b/src/dnssec/shared/print.h
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
diff --git a/src/dnssec/utils/.gitignore b/src/dnssec/utils/.gitignore
deleted file mode 100644
index ce1ce517f7d637509b7cd4b368307d4d902f1629..0000000000000000000000000000000000000000
--- a/src/dnssec/utils/.gitignore
+++ /dev/null
@@ -1,6 +0,0 @@
-/Makefile
-/Makefile.in
-
-# utilities
-/keymgr
-/knsec3hash
diff --git a/src/dnssec/utils/Makefile.am b/src/dnssec/utils/Makefile.am
deleted file mode 100644
index c9586c34b540dca18a0d060004a688e55b8ef971..0000000000000000000000000000000000000000
--- a/src/dnssec/utils/Makefile.am
+++ /dev/null
@@ -1,47 +0,0 @@
-if HAVE_UTILS
-
-noinst_LTLIBRARIES = libutils.la
-
-AM_CPPFLAGS = \
-	-include $(top_builddir)/src/config.h \
-	-I$(srcdir)/../shared \
-	-I$(srcdir)/../lib/dnssec \
-	-I$(srcdir)/../lib \
-	-I$(top_srcdir)/src \
-	$(gnutls_CFLAGS)
-
-libutils_la_LIBADD = \
-	$(builddir)/../libdnssec.la \
-	$(builddir)/../libshared.la \
-	$(top_builddir)/src/zscanner/libzscanner.la
-
-libutils_la_SOURCES = \
-	cmdparse/command.c \
-	cmdparse/command.h \
-	cmdparse/match.h \
-	cmdparse/parameter.c \
-	cmdparse/parameter.h \
-	cmdparse/value.c \
-	cmdparse/value.h \
-	legacy/key.c \
-	legacy/key.h \
-	legacy/privkey.c \
-	legacy/privkey.h \
-	legacy/pubkey.c \
-	legacy/pubkey.h \
-	print.h
-
-keymgr_LDADD = \
-	libutils.la
-
-knsec3hash_LDADD = \
-	$(builddir)/../libdnssec.la \
-	$(builddir)/../libshared.la
-
-sbin_PROGRAMS = \
-	keymgr
-
-bin_PROGRAMS =	\
-	knsec3hash
-
-endif # HAVE_UTILS
diff --git a/src/dnssec/utils/cmdparse/command.c b/src/utils/keymgr/cmdparse/command.c
similarity index 91%
rename from src/dnssec/utils/cmdparse/command.c
rename to src/utils/keymgr/cmdparse/command.c
index 6a04ddc45053b059a5e2081fb21a5b30ad1a9bcd..fd5184321311b943568c64e97cc61614aa47665f 100644
--- a/src/dnssec/utils/cmdparse/command.c
+++ b/src/utils/keymgr/cmdparse/command.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -14,9 +14,9 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#include "cmdparse/command.h"
-#include "cmdparse/match.h"
-#include "print.h"
+#include "shared/print.h"
+#include "utils/keymgr/cmdparse/command.h"
+#include "utils/keymgr/cmdparse/match.h"
 
 #include <assert.h>
 #include <string.h>
diff --git a/src/dnssec/utils/cmdparse/command.h b/src/utils/keymgr/cmdparse/command.h
similarity index 100%
rename from src/dnssec/utils/cmdparse/command.h
rename to src/utils/keymgr/cmdparse/command.h
diff --git a/src/dnssec/utils/cmdparse/match.h b/src/utils/keymgr/cmdparse/match.h
similarity index 100%
rename from src/dnssec/utils/cmdparse/match.h
rename to src/utils/keymgr/cmdparse/match.h
diff --git a/src/dnssec/utils/cmdparse/parameter.c b/src/utils/keymgr/cmdparse/parameter.c
similarity index 94%
rename from src/dnssec/utils/cmdparse/parameter.c
rename to src/utils/keymgr/cmdparse/parameter.c
index 50e067fde329a905972259a377d5947c50aa13f5..94425fd0a0188cbb3db472cdbc8fdda65c054b84 100644
--- a/src/dnssec/utils/cmdparse/parameter.c
+++ b/src/utils/keymgr/cmdparse/parameter.c
@@ -14,9 +14,9 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#include "cmdparse/match.h"
-#include "cmdparse/parameter.h"
-#include "print.h"
+#include "shared/print.h"
+#include "utils/keymgr/cmdparse/match.h"
+#include "utils/keymgr/cmdparse/parameter.h"
 
 #include <assert.h>
 
diff --git a/src/dnssec/utils/cmdparse/parameter.h b/src/utils/keymgr/cmdparse/parameter.h
similarity index 100%
rename from src/dnssec/utils/cmdparse/parameter.h
rename to src/utils/keymgr/cmdparse/parameter.h
diff --git a/src/dnssec/utils/cmdparse/value.c b/src/utils/keymgr/cmdparse/value.c
similarity index 98%
rename from src/dnssec/utils/cmdparse/value.c
rename to src/utils/keymgr/cmdparse/value.c
index 08641449f954b5b1e5b49e43f0f3a1a8149f89ec..3a7e954e7db3c0c214e3c866ede243612393f83f 100644
--- a/src/dnssec/utils/cmdparse/value.c
+++ b/src/utils/keymgr/cmdparse/value.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -14,10 +14,10 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
-#include "cmdparse/value.h"
 #include "dnssec/key.h"
 #include "dnssec/tsig.h"
-#include "print.h"
+#include "shared/print.h"
+#include "utils/keymgr/cmdparse/value.h"
 
 #include <assert.h>
 #include <ctype.h>
diff --git a/src/dnssec/utils/cmdparse/value.h b/src/utils/keymgr/cmdparse/value.h
similarity index 97%
rename from src/dnssec/utils/cmdparse/value.h
rename to src/utils/keymgr/cmdparse/value.h
index ca5f59663bdb8baae5dddd3fb4ce6caf2356496a..b8796733f031b96d07365b3c56c85bc72e173127 100644
--- a/src/dnssec/utils/cmdparse/value.h
+++ b/src/utils/keymgr/cmdparse/value.h
@@ -16,7 +16,7 @@
 
 #pragma once
 
-#include "cmdparse/parameter.h"
+#include "utils/keymgr/cmdparse/parameter.h"
 
 /*!
  * bool (set only)
diff --git a/src/dnssec/utils/keymgr.c b/src/utils/keymgr/keymgr.c
similarity index 99%
rename from src/dnssec/utils/keymgr.c
rename to src/utils/keymgr/keymgr.c
index 1dc25a6e76e1ba184481827251e01ab153795c2e..05355ce421ef4c4ed5d8b51393101890e23e2046 100644
--- a/src/dnssec/utils/keymgr.c
+++ b/src/utils/keymgr/keymgr.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -30,12 +30,12 @@
 #include "cmdparse/command.h"
 #include "cmdparse/parameter.h"
 #include "cmdparse/value.h"
-#include "dname.h"
 #include "legacy/key.h"
-#include "print.h"
-#include "shared.h"
-#include "strtonum.h"
-#include "wire.h"
+#include "shared/dname.h"
+#include "shared/print.h"
+#include "shared/shared.h"
+#include "shared/strtonum.h"
+#include "shared/wire.h"
 
 #define PROGRAM_NAME "keymgr"
 
diff --git a/src/dnssec/utils/legacy/key.c b/src/utils/keymgr/legacy/key.c
similarity index 96%
rename from src/dnssec/utils/legacy/key.c
rename to src/utils/keymgr/legacy/key.c
index 5a4778a794335b9531241813a8a50c4c8217e1aa..408cbec1a20a416d3ef5756a717c66431a177e93 100644
--- a/src/dnssec/utils/legacy/key.c
+++ b/src/utils/keymgr/legacy/key.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -23,11 +23,11 @@
 #include "dnssec/binary.h"
 #include "dnssec/error.h"
 #include "dnssec/kasp.h"
-#include "legacy/key.h"
-#include "legacy/privkey.h"
-#include "legacy/pubkey.h"
-#include "pem.h"
-#include "shared.h"
+#include "shared/pem.h"
+#include "shared/shared.h"
+#include "utils/keymgr/legacy/key.h"
+#include "utils/keymgr/legacy/privkey.h"
+#include "utils/keymgr/legacy/pubkey.h"
 
 static int rsa_params_to_pem(const legacy_privkey_t *params, dnssec_binary_t *pem)
 {
diff --git a/src/dnssec/utils/legacy/key.h b/src/utils/keymgr/legacy/key.h
similarity index 100%
rename from src/dnssec/utils/legacy/key.h
rename to src/utils/keymgr/legacy/key.h
diff --git a/src/dnssec/utils/legacy/privkey.c b/src/utils/keymgr/legacy/privkey.c
similarity index 97%
rename from src/dnssec/utils/legacy/privkey.c
rename to src/utils/keymgr/legacy/privkey.c
index c2f1e4ec9236000fa9a291ff99bfaee519e1fe59..ac9925b39a3ec7b991e8f7cd26b5dad8ec822b17 100644
--- a/src/dnssec/utils/legacy/privkey.c
+++ b/src/utils/keymgr/legacy/privkey.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2014 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -19,9 +19,9 @@
 
 #include "dnssec/binary.h"
 #include "dnssec/error.h"
-#include "legacy/privkey.h"
-#include "shared.h"
-#include "strtonum.h"
+#include "shared/shared.h"
+#include "shared/strtonum.h"
+#include "utils/keymgr/legacy/privkey.h"
 
 /* -- private key params conversion ---------------------------------------- */
 
diff --git a/src/dnssec/utils/legacy/privkey.h b/src/utils/keymgr/legacy/privkey.h
similarity index 100%
rename from src/dnssec/utils/legacy/privkey.h
rename to src/utils/keymgr/legacy/privkey.h
diff --git a/src/dnssec/utils/legacy/pubkey.c b/src/utils/keymgr/legacy/pubkey.c
similarity index 98%
rename from src/dnssec/utils/legacy/pubkey.c
rename to src/utils/keymgr/legacy/pubkey.c
index aa9554ad5bb3325b91394f27459671096c152cdb..95033bf3f3f80c244ba249220d5fc46e99435382 100644
--- a/src/dnssec/utils/legacy/pubkey.c
+++ b/src/utils/keymgr/legacy/pubkey.c
@@ -22,8 +22,7 @@
 #include "dnssec/error.h"
 #include "dnssec/binary.h"
 #include "dnssec/key.h"
-
-#include "legacy/pubkey.h"
+#include "utils/keymgr/legacy/pubkey.h"
 
 #define CLASS_IN 1
 #define RTYPE_DNSKEY 48
diff --git a/src/dnssec/utils/legacy/pubkey.h b/src/utils/keymgr/legacy/pubkey.h
similarity index 100%
rename from src/dnssec/utils/legacy/pubkey.h
rename to src/utils/keymgr/legacy/pubkey.h
diff --git a/src/dnssec/utils/knsec3hash.c b/src/utils/knsec3hash/knsec3hash.c
similarity index 95%
rename from src/dnssec/utils/knsec3hash.c
rename to src/utils/knsec3hash/knsec3hash.c
index 9725a01e0bf2bcce6155ee57e176caf6b9fb0634..490980dce854d6d3dff0dbe31e734f71b99bed1f 100644
--- a/src/dnssec/utils/knsec3hash.c
+++ b/src/utils/knsec3hash/knsec3hash.c
@@ -1,4 +1,4 @@
-/*  Copyright (C) 2011 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -21,13 +21,13 @@
 #include <stdio.h>
 #include <string.h>
 
-#include "base32hex.h"
-#include "dname.h"
 #include "dnssec/error.h"
 #include "dnssec/nsec.h"
-#include "hex.h"
-#include "print.h"
-#include "strtonum.h"
+#include "shared/base32hex.h"
+#include "shared/dname.h"
+#include "shared/hex.h"
+#include "shared/print.h"
+#include "shared/strtonum.h"
 
 #define PROGRAM_NAME "knsec3hash"
 
diff --git a/tests-extra/tools/dnstest/params.py b/tests-extra/tools/dnstest/params.py
index 28a22e15015f217665ab815108ded8bca6d93333..a723800f508bbc00ee82a1b36f83e9f9aa87e928 100644
--- a/tests-extra/tools/dnstest/params.py
+++ b/tests-extra/tools/dnstest/params.py
@@ -55,7 +55,7 @@ knot_bin = get_binary("KNOT_TEST_KNOT", repo_binary("src/knotd"))
 # KNOT_TEST_KNOTC - Knot control binary.
 knot_ctl = get_binary("KNOT_TEST_KNOTC", repo_binary("src/knotc"))
 # KNOT_TEST_KEYMGR - Knot key management binary.
-keymgr_bin = get_binary("KNOT_TEST_KEYMGR", repo_binary("src/dnssec/utils/keymgr"))
+keymgr_bin = get_binary("KNOT_TEST_KEYMGR", repo_binary("src/keymgr"))
 # KNOT_TEST_BIND - Bind binary.
 bind_bin = get_binary("KNOT_TEST_BIND", "named")
 # KNOT_TEST_BINDC - Bind control binary.