diff --git a/NEWS b/NEWS
index 2a917cd5b..d15027609 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ Noteworthy changes in version 2.3.0 (unreleased)
     put "use-keyboxd" into gpg.conf and gpgsm.conf.  Keys are stored
     in a SQLite database and make key lookup much faster.
 
+  * The gpg-wks-client tool is now installed under bin; a wrapper for
+    its old location at libexec is also installed.
+
 
   Changes also found in 2.2.27:
 
diff --git a/build-aux/speedo/w32/inst.nsi b/build-aux/speedo/w32/inst.nsi
index 2c6c9be78..6267b644a 100644
--- a/build-aux/speedo/w32/inst.nsi
+++ b/build-aux/speedo/w32/inst.nsi
@@ -626,10 +626,10 @@ Section "GnuPG" SEC_gnupg
   File "bin/gpg-connect-agent.exe"
   File "bin/gpg-card.exe"
   File "bin/gpgtar.exe"
+  File "bin/gpg-wks-client.exe"
   File "libexec/dirmngr_ldap.exe"
   File "libexec/gpg-preset-passphrase.exe"
   File "libexec/gpg-check-pattern.exe"
-  File "libexec/gpg-wks-client.exe"
 
   ClearErrors
   SetOverwrite try
diff --git a/doc/wks.texi b/doc/wks.texi
index d6f442dfc..ad239f132 100644
--- a/doc/wks.texi
+++ b/doc/wks.texi
@@ -109,15 +109,6 @@ The command @option{--print-wkd-url} prints the URLs used to fetch the
 key for the given user-ids from WKD.  The meanwhile preferred format
 with sub-domains is used here.
 
-@command{gpg-wks-client} is not commonly invoked directly and thus it
-is not installed in the bin directory.  Here is an example how it can
-be invoked manually to check for a Web Key Directory entry for
-@file{foo@@example.org}:
-
-@example
-$(gpgconf --list-dirs libexecdir)/gpg-wks-client --check foo@@example.net
-@end example
-
 @mansect options
 @noindent
 @command{gpg-wks-client} understands these options:
diff --git a/tools/Makefile.am b/tools/Makefile.am
index 07edf09aa..6ca596c7e 100644
--- a/tools/Makefile.am
+++ b/tools/Makefile.am
@@ -43,17 +43,15 @@ else
   gpg_wks_server =
 endif
 
-libexec_PROGRAMS = gpg-wks-client
 
-bin_PROGRAMS = gpgconf gpg-connect-agent gpg-card
+bin_PROGRAMS = gpgconf gpg-connect-agent gpg-card gpg-wks-client
 if !HAVE_W32_SYSTEM
 bin_PROGRAMS += watchgnupg gpgparsemail ${gpg_wks_server} gpgsplit
 else
 bin_PROGRAMS += gpgconf-w32
 endif
 
-libexec_PROGRAMS += gpg-check-pattern
-libexec_PROGRAMS += gpg-pair-tool
+libexec_PROGRAMS = gpg-check-pattern gpg-pair-tool
 
 if !HAVE_W32CE_SYSTEM
 noinst_PROGRAMS = clean-sat make-dns-cert
@@ -191,6 +189,22 @@ gpg_pair_tool_LDADD =  $(libcommon) \
 		       $(LIBGCRYPT_LIBS) $(GPG_ERROR_LIBS) \
 		       $(LIBINTL) $(LIBICONV) $(W32SOCKLIBS)
 
+# Instead of a symlink we install a simple wrapper script for the new
+# gpg-wks-client location.  We assume bin is a sibling of libexec.
+install-exec-local:
+	$(mkinstalldirs) $(DESTDIR)$(libexecdir)
+	(set -e ;\
+	 if [ "$(libexecdir)" != "$(bindir)" ]; then \
+	   printf '#!/bin/sh\nexec "$(bindir)/gpg-wks-client" "$$@"\n' \
+	          > $(DESTDIR)$(libexecdir)/gpg-wks-client ;\
+	   chmod +x $(DESTDIR)$(libexecdir)/gpg-wks-client ;\
+	 fi )
+
+uninstall-local:
+	(if [ "$(libexecdir)" != "$(bindir)" ]; then \
+	   rm $(DESTDIR)$(libexecdir)/gpg-wks-client || true ;\
+         fi )
+
 # Make sure that all libs are build before we use them.  This is
 # important for things like make -j2.
 $(PROGRAMS): $(common_libs) $(pwquery_libs) ../common/libgpgrl.a