diff --git a/README.md b/README.md
index 2ddc64a..a6412d6 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ $ encrypt-otp otp_accounts.json
 
 ## cbc-file
 
-Hidden utility, does the encryption magic. Despite the name, uses
+Mostly hidden utility, does the encryption magic. Despite the name, uses
 [ChaCha20+Poly1305](https://tools.ietf.org/html/rfc7539) for encryption, as
 implemented by [BearSSL](https://www.bearssl.org/), together with
 [argon2](https://github.com/p-h-c/phc-winner-argon2) for key derivation.
diff --git a/encrypt-otp.in b/encrypt-otp.in
index 4adb127..52d6829 100644
--- a/encrypt-otp.in
+++ b/encrypt-otp.in
@@ -7,7 +7,7 @@ if [ ! -e "$file" ]; then
 	exit 1
 fi
 
-if @PREFIX@/libexec/cbc-file lock "$file" > "$dest"; then
+if @PREFIX@/bin/cbc-file lock "$file" > "$dest"; then
 	echo "'$dest' successfully generated!"
 	exit 0
 else
diff --git a/get-otp.in b/get-otp.in
index 584edaa..01ecb89 100644
--- a/get-otp.in
+++ b/get-otp.in
@@ -1,6 +1,6 @@
 #!/bin/sh
 file="${OTP_ACCOUNTS:-$HOME/.local/share/otp_accounts}"
-json="$(@PREFIX@/libexec/cbc-file unlock "$file")"
+json="$(@PREFIX@/bin/cbc-file unlock "$file")"
 [ -z "$json" ] && exit 1
 
 label="$(printf %s "$json" |
diff --git a/makefile b/makefile
index f7fd7f9..3e4cb75 100644
--- a/makefile
+++ b/makefile
@@ -14,8 +14,7 @@ encrypt-otp: encrypt-otp.in
 
 install: all
 	mkdir -p $(DESTDIR)$(PREFIX)/bin
-	mkdir -p $(DESTDIR)$(PREFIX)/libexec
-	install -Dm755 cbc-file $(DESTDIR)$(PREFIX)/libexec/
+	install -Dm755 cbc-file $(DESTDIR)$(PREFIX)/bin/
 	install -Dm755 get-otp $(DESTDIR)$(PREFIX)/bin/
 	install -Dm755 encrypt-otp $(DESTDIR)$(PREFIX)/bin/