diff --git a/polkit.changes b/polkit.changes
index 220b41a..350ea7b 100644
--- a/polkit.changes
+++ b/polkit.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Mon Dec 28 12:26:34 UTC 2020 - Matthias Gerstner <matthias.gerstner@suse.com>
+
+- Install private binaries into libexec instead of into lib. For this an
+  override of the custom libprivdir variable is necessary, because upstream
+  explicitly moved away from libexecdir via upstram commit
+  6fbcc6cd839680fcefd81c4a43676e7c031c9859.
+
 -------------------------------------------------------------------
 Fri Oct 23 08:19:06 UTC 2020 - Bjørn Lie <bjorn.lie@gmail.com>
 
diff --git a/polkit.spec b/polkit.spec
index 335f54e..13b78d7 100644
--- a/polkit.spec
+++ b/polkit.spec
@@ -133,7 +133,12 @@ export SUID_LDFLAGS="-z now -pie"
 %make_build
 
 %install
-%make_install
+# install explicitly into libexec. upstream has some unflexible logic for
+# these executable at the moment, but there is a PR# open to fix this:
+#     https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/63
+# once this has been resolved upstream and we update to a new release we can
+# remove this.
+%make_install libprivdir=%{_libexecdir}/polkit-1
 find %{buildroot} -type f -name "*.la" -delete -print
 # create $HOME for polkit user
 install -d %{buildroot}%{_localstatedir}/lib/polkit
@@ -198,9 +203,9 @@ exit 0
 %{_bindir}/pkcheck
 %verify(not mode) %attr(4755,root,root) %{_bindir}/pkexec
 %{_bindir}/pkttyagent
-%dir %{_prefix}/lib/polkit-1
-%{_prefix}/lib/polkit-1/polkitd
-%verify(not mode) %attr(4755,root,root) %{_prefix}/lib/polkit-1/polkit-agent-helper-1
+%dir %{_libexecdir}/polkit-1
+%{_libexecdir}/polkit-1/polkitd
+%verify(not mode) %attr(4755,root,root) %{_libexecdir}/polkit-1/polkit-agent-helper-1
 # $HOME for polkit user
 %dir %{_localstatedir}/lib/polkit
 %{_unitdir}/polkit.service