diff --git a/Makefile b/Makefile
index 1bab989172..636cc908a3 100644
--- a/Makefile
+++ b/Makefile
@@ -174,7 +174,7 @@ osxapp: Build/Standalone Build/OSXMkLibs
 	ln -sf git-annex "$(OSXAPP_BASE)/git-annex-shell"
 	gzcat standalone/licences.gz > $(OSXAPP_BASE)/LICENSE
 	cp $(OSXAPP_BASE)/LICENSE tmp/build-dmg/LICENSE.txt
-	cp standalone/trustedkeys.gpg $(OSXAPP_BASE)
+	cp standalone/trustedkeys.gpg $(OSXAPP_DEST)
 
 	./Build/Standalone $(OSXAPP_BASE)
 
diff --git a/debian/changelog b/debian/changelog
index 9c3b8c9a12..3ada531a62 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -25,6 +25,9 @@ git-annex (5.20150508.2) UNRELEASED; urgency=medium
     Closes: #785498
   * Safer posix fctnl locking implementation, using lock pools and STM.
   * Build documentation with TZ=UTC for reproducible builds. See #785736.
+  * OSX: Corrected the location of trustedkeys.gpg, so the built-in
+    upgrade code will find it. Fixes OSX upgrade going forward, but
+    older versions won't upgrade themselves due to this problem.
 
  -- Joey Hess <id@joeyh.name>  Mon, 11 May 2015 12:45:06 -0400
 
diff --git a/doc/forum/OSX:_Upgrader:_Failed_to_check_if_upgrade_is_available./comment_1_ac7c1f39e723cbcd49d6497649e7e44f._comment b/doc/forum/OSX:_Upgrader:_Failed_to_check_if_upgrade_is_available./comment_1_ac7c1f39e723cbcd49d6497649e7e44f._comment
new file mode 100644
index 0000000000..39eae02a8b
--- /dev/null
+++ b/doc/forum/OSX:_Upgrader:_Failed_to_check_if_upgrade_is_available./comment_1_ac7c1f39e723cbcd49d6497649e7e44f._comment
@@ -0,0 +1,13 @@
+[[!comment format=mdwn
+ username="joey"
+ subject="""comment 1"""
+ date="2015-05-22T17:35:11Z"
+ content="""
+Aha, this is a path propel to the trustedkeys.gpg file, it's in bundle/
+in the OSX app, and git-annex tells gpg to look in the parent directory
+instead.
+
+Fixed in git. Unfortunately I can't fix old versions of git-annex so
+OSX users will need to manually upgrade to version 5.20150522 to get this
+fix.
+"""]]