diff --git a/Makefile b/Makefile
index 6f0caf753c..dae2d5d5bd 100644
--- a/Makefile
+++ b/Makefile
@@ -118,6 +118,7 @@ linuxstandalone-nobuild: Build/Standalone Build/LinuxMkLibs
 	rm -rf "$(LINUXSTANDALONE_DEST)"
 	mkdir -p tmp
 	cp -R standalone/linux/skel "$(LINUXSTANDALONE_DEST)"
+	sed -i -e 's/^GIT_ANNEX_PACKAGE_INSTALL=/GIT_ANNEX_PACKAGE_INSTALL=$(GIT_ANNEX_PACKAGE_INSTALL)/' "$(LINUXSTANDALONE_DEST)/runshell"
 	
 	install -d "$(LINUXSTANDALONE_DEST)/bin"
 	cp dist/build/git-annex/git-annex "$(LINUXSTANDALONE_DEST)/bin/"
diff --git a/debian/changelog b/debian/changelog
index 18a8556618..739579f17e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -18,6 +18,8 @@ git-annex (5.20151102.2) UNRELEASED; urgency=medium
     support that; avoid crashing on such invalid encoding.
   * runshell: Avoid failing when $HOME/.ssh does not exist and cannot be
     created.
+  * Make the git-annex-standalone.deb prevent runshell from installing
+    wrappers into $HOME/.ssh
 
  -- Joey Hess <id@joeyh.name>  Wed, 04 Nov 2015 12:50:20 -0400
 
diff --git a/debian/rules b/debian/rules
index 927c1c9259..294cb30283 100755
--- a/debian/rules
+++ b/debian/rules
@@ -16,7 +16,7 @@ export RELEASE_BUILD=1
 ifeq ($(STANDALONE_BUILD),1)
 
 override_dh_auto_build:
-	make linuxstandalone
+	make linuxstandalone GIT_ANNEX_PACKAGE_INSTALL=1
 
 override_dh_auto_install:
 	: # nothing to do, we just need to copy the beast, as instructed in debian/install
diff --git a/standalone/linux/skel/runshell b/standalone/linux/skel/runshell
index 68a462266b..8c1db42476 100755
--- a/standalone/linux/skel/runshell
+++ b/standalone/linux/skel/runshell
@@ -42,35 +42,41 @@ if echo "$base" | grep -q '[:;]'; then
 	trap cleanuptbase EXIT
 fi
 
-# Install shim that's used to run git-annex-shell from ssh authorized_keys.
-# The assistant also does this when run, but the user may not be using the
-# assistant.
-if [ ! -e "$HOME/.ssh/git-annex-shell" ]; then
-	mkdir "$HOME/.ssh" >/dev/null 2>&1 || true
-	if [ -e "$HOME/.ssh" ]; then
-		(
-			echo "#!/bin/sh"
-			echo "set -e"
-			echo "if [ \"x\$SSH_ORIGINAL_COMMAND\" != \"x\" ]; then"
-			echo "exec '$base/runshell' git-annex-shell -c \"\$SSH_ORIGINAL_COMMAND\""
-			echo "else"
-			echo "exec '$base/runshell' git-annex-shell -c \"\$@\""
-			echo "fi"
-		) > "$HOME/.ssh/git-annex-shell"
-		chmod +x "$HOME/.ssh/git-annex-shell"
+# Set this variable when using this script inside a package of git-annex,
+# which arranges for git-annex, git-annex-shell, and git to all be in the
+# standard PATH.
+GIT_ANNEX_PACKAGE_INSTALL=
+if [ -z "$GIT_ANNEX_PACKAGE_INSTALL" ]; then
+	# Install shim that's used to run git-annex-shell from ssh authorized
+	# keys. The assistant also does this when run, but the user may not
+	# be using the assistant.
+	if [ ! -e "$HOME/.ssh/git-annex-shell" ]; then
+		mkdir "$HOME/.ssh" >/dev/null 2>&1 || true
+		if [ -e "$HOME/.ssh" ]; then
+			(
+				echo "#!/bin/sh"
+				echo "set -e"
+				echo "if [ \"x\$SSH_ORIGINAL_COMMAND\" != \"x\" ]; then"
+				echo "exec '$base/runshell' git-annex-shell -c \"\$SSH_ORIGINAL_COMMAND\""
+				echo "else"
+				echo "exec '$base/runshell' git-annex-shell -c \"\$@\""
+				echo "fi"
+			) > "$HOME/.ssh/git-annex-shell"
+			chmod +x "$HOME/.ssh/git-annex-shell"
+		fi
 	fi
-fi
 
-# And this shim is used by the webapp when adding a remote ssh server.
-if [ ! -e "$HOME/.ssh/git-annex-wrapper" ]; then
-	mkdir "$HOME/.ssh" >/dev/null 2>&1 || true
-	if [ -e "$HOME/.ssh" ]; then
-		(
-			echo "#!/bin/sh"
-			echo "set -e"
-			echo "exec '$base/runshell' \"\$@\""
-		) > "$HOME/.ssh/git-annex-wrapper"
-		chmod +x "$HOME/.ssh/git-annex-wrapper"
+	# And this shim is used by the webapp when adding a remote ssh server.
+	if [ ! -e "$HOME/.ssh/git-annex-wrapper" ]; then
+		mkdir "$HOME/.ssh" >/dev/null 2>&1 || true
+		if [ -e "$HOME/.ssh" ]; then
+			(
+				echo "#!/bin/sh"
+				echo "set -e"
+				echo "exec '$base/runshell' \"\$@\""
+			) > "$HOME/.ssh/git-annex-wrapper"
+			chmod +x "$HOME/.ssh/git-annex-wrapper"
+		fi
 	fi
 fi