diff --git a/release/packages/certctl.ucl b/release/packages/caroot.ucl
rename from release/packages/certctl.ucl
rename to release/packages/caroot.ucl
--- a/release/packages/certctl.ucl
+++ b/release/packages/caroot.ucl
@@ -15,11 +15,6 @@
 %DESC%
 EOD
 scripts: {
-	# XXX If pkg picks up a mechanism to detect in the post-install script
-	# files being added or removed, we should use it instead to gate the
-	# rehash.
-	post-install = <<EOD
-	[ -x /usr/sbin/certctl ] && env DESTDIR=${PKG_ROOTDIR} \
-	    /usr/sbin/certctl rehash
-EOD
+	post-install = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ rehash"
+	post-uninstall = "/usr/sbin/certctl -D${PKG_ROOTDIR}/ rehash"
 }
diff --git a/release/packages/generate-ucl.sh b/release/packages/generate-ucl.sh
--- a/release/packages/generate-ucl.sh
+++ b/release/packages/generate-ucl.sh
@@ -36,13 +36,16 @@
 		bootloader)
 			pkgdeps=""
 			;;
+		caroot)
+			pkgdeps="certctl"
+			;;
 		clibs)
 			vital="true"
 			# clibs should not have any dependencies or anything
 			# else imposed on it.
 			;;
 		certctl)
-			pkgdeps="caroot openssl"
+			pkgdeps="openssl"
 			;;
 		clang)
 			pkgdeps="lld clang-dev libcompiler_rt-dev"