diff --git a/debian/control b/debian/control
index 5bf4f3e47051b77d022e38221f32de2c1bcf844e..70dd600047116533b9d50ffb0c4a988284c24ce2 100644
--- a/debian/control
+++ b/debian/control
@@ -11,3 +11,9 @@ Depends: ${shlibs:Depends}, ${misc:Depends}
 Description: User private key server.
  Stores user encryption keys in-memory for the session duration.
 
+Package: dovecot-keylookupd
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}, dovecot-core
+Description: Dovecot dict proxy for user encryption keys.
+ Look up user encryption keys via the Dovecot dict proxy protocol.
+
diff --git a/debian/dovecot-keylookupd.service b/debian/dovecot-keylookupd.service
new file mode 100644
index 0000000000000000000000000000000000000000..38f45af234665ae24195a9475cdff96b1d2aa624
--- /dev/null
+++ b/debian/dovecot-keylookupd.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Dovecot keylookupd server
+Requires=dovecot-keylookupd.socket
+
+[Service]
+Type=notify
+ExecStart=/usr/bin/dovecot-keylookupd --systemd-socket
+Restart=on-failure
+User=dovecot
+
+[Install]
+WantedBy=multi-user.target
+
diff --git a/debian/dovecot-keylookupd.socket b/debian/dovecot-keylookupd.socket
new file mode 100644
index 0000000000000000000000000000000000000000..bbd6f09f872010368e5b5e953f457ed595f242ad
--- /dev/null
+++ b/debian/dovecot-keylookupd.socket
@@ -0,0 +1,11 @@
+[Unit]
+Description=Dovecot keylookupd socket
+
+[Socket]
+ListenStream=/run/dovecot-keylookupd/socket
+SocketMode=660
+DirectoryMode=755
+SocketUser=dovecot
+SocketGroup=dovecot
+Accept=false
+
diff --git a/debian/rules b/debian/rules
index b706a60521ffc9f880c4f4216c8bbb1783ea484d..edf0c4a7026e27253226af3ca28946ac8e95428d 100755
--- a/debian/rules
+++ b/debian/rules
@@ -8,6 +8,6 @@ export DH_GOLANG_EXCLUDES = vendor
 	dh $@ --with systemd --with golang --buildsystem golang
 
 override_dh_install:
-	rm -fr $(CURDIR)/debian/keystored/usr/share/gocode
+	rm -fr $(CURDIR)/debian/tmp/usr/share/gocode
 	dh_install