diff --git a/debian/bin/gencontrol_signed.py b/debian/bin/gencontrol_signed.py
index 7745bad0a..9c47c3cf8 100755
--- a/debian/bin/gencontrol_signed.py
+++ b/debian/bin/gencontrol_signed.py
@@ -293,7 +293,7 @@ linux-signed-@arch@ (@signedsourceversion@) @distribution@; urgency=@urgency@
             hasher.update(ssl.PEM_cert_to_DER_cert(cert))
             return hasher.hexdigest()
 
-        all_files = {}
+        all_files = {'packages': {}}
 
         for image_suffix, image_package_name, cert_file_name in \
                 self.image_packages:
@@ -312,7 +312,7 @@ linux-signed-@arch@ (@signedsourceversion@) @distribution@; urgency=@urgency@
             package_certs = [get_cert_fingerprint(cert, 'sha256')
                              for cert in get_certs(cert_file_name)]
             assert len(package_certs) >= 1
-            all_files[image_package_name] = {
+            all_files['packages'][image_package_name] = {
                 'trusted_certs': package_certs,
                 'files': package_files
             }
diff --git a/debian/changelog b/debian/changelog
index f6a723d65..8c7a5240f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -688,6 +688,7 @@ linux (4.19.28-1) UNRELEASED; urgency=medium
     {fb,input,nic,scsi}-modules
   * debian/bin/gencontrol.py: Add rules to build debian/build/config.*
   * certs: Replace test signing certificate with production signing certificate
+  * debian/bin/gencontrol_signed.py: Put all files.json fields under "packages"
 
   [ Wookey ]
   * linux-perf: Enable coresight trace (libopencsd) support in perf