diff --git a/release/packages/ucl/caroot.ucl b/release/packages/ucl/caroot.ucl
new file mode 100644
--- /dev/null
+++ b/release/packages/ucl/caroot.ucl
@@ -0,0 +1,10 @@
+deps {
+	"certctl": {
+		version = "${VERSION}"
+		origin = "base"
+	}
+}
+scripts: {
+	post-install = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ rehash"
+	post-uninstall = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ rehash"
+}
diff --git a/release/packages/ucl/certctl.ucl b/release/packages/ucl/certctl.ucl
--- a/release/packages/ucl/certctl.ucl
+++ b/release/packages/ucl/certctl.ucl
@@ -1,21 +1,6 @@
 deps {
-	"caroot": {
-		version = "${VERSION}"
-		origin = "base"
-	}
-
 	"openssl": {
 		version = "${VERSION}"
 		origin = "base"
 	}
 }
-
-scripts: {
-	# XXX If pkg picks up a mechanism to detect in the post-install script
-	# files being added or removed, we should use it instead to gate the
-	# rehash.
-	post-install = <<EOD
-	[ -x /usr/sbin/certctl ] && env DESTDIR=${PKG_ROOTDIR} \
-	    /usr/sbin/certctl rehash
-EOD
-}