diff --git a/.github/workflows/pkg.yml b/.github/workflows/pkg.yml
index 6cbe29e6..69ae146c 100644
--- a/.github/workflows/pkg.yml
+++ b/.github/workflows/pkg.yml
@@ -11,7 +11,7 @@ on:
   workflow_dispatch:
 
 jobs:
-  package:
+  package-dnst:
     uses: NLnetLabs/ploutos/.github/workflows/pkg-rust.yml@v9
     secrets:
       DOCKER_HUB_ID: ${{ vars.DOCKER_HUB_ID }}
@@ -31,3 +31,16 @@ jobs:
       deb_extra_build_packages: libssl-dev
       rpm_extra_build_packages: make openssl-devel
       rpm_scriptlets_path: pkg/rpm/scriptlets.toml
+
+  package-dnst-ldnsutils:
+    # Package empty dnst-ldnsutils package to create symlinks
+    uses: NLnetLabs/ploutos/.github/workflows/pkg-rust.yml@v9
+    with:
+      package_build_rules: pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml
+      package_test_rules: pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml
+      package_test_scripts_path: pkg/dnst-ldnsutils/pkg/test-scripts/test-<package>.sh
+
+      rpm_scriptlets_path: pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml
+
+      manifest_dir: pkg/dnst-ldnsutils
+      artifact_prefix: dnst-ldnsutils
diff --git a/Cargo.lock b/Cargo.lock
index 7076ae4a..ddf4c5c0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -315,7 +315,7 @@ dependencies = [
 
 [[package]]
 name = "dnst"
-version = "0.1.1-dev"
+version = "0.2.0-alpha1"
 dependencies = [
  "bytes",
  "chrono",
diff --git a/Cargo.toml b/Cargo.toml
index d919a059..adcf3bcb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "dnst"
-version = "0.1.1-dev"
+version = "0.2.0-alpha1"
 edition = "2021"
 default-run = "dnst"
 readme = "README.md"
@@ -97,19 +97,10 @@ assets = [
     ["doc/manual/build/man/dnst-nsec3-hash.1", "/usr/share/man/man1/dnst-nsec3-hash.1", "644"],
     ["doc/manual/build/man/dnst-signzone.1", "/usr/share/man/man1/dnst-signzone.1", "644"],
     ["doc/manual/build/man/dnst-update.1", "/usr/share/man/man1/dnst-update.1", "644"],
-    ["doc/manual/build/man/ldns-key2ds.1", "/usr/share/man/man1/ldns-key2ds.1", "644"],
-    ["doc/manual/build/man/ldns-keygen.1", "/usr/share/man/man1/ldns-keygen.1", "644"],
-    ["doc/manual/build/man/ldns-notify.1", "/usr/share/man/man1/ldns-notify.1", "644"],
-    ["doc/manual/build/man/ldns-nsec3-hash.1", "/usr/share/man/man1/ldns-nsec3-hash.1", "644"],
-    ["doc/manual/build/man/ldns-signzone.1", "/usr/share/man/man1/ldns-signzone.1", "644"],
-    ["doc/manual/build/man/ldns-update.1", "/usr/share/man/man1/ldns-update.1", "644"],
 ]
 changelog = "target/debian/changelog" # this will be generated by the pkg workflow
 copyright = "Copyright (c) 2024, NLnet Labs. All rights reserved."
 maintainer-scripts = "pkg/debian"
-# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#replacing-whole-packages-forcing-their-removal
-conflicts = "ldnsutils"
-replaces = "ldnsutils"
 
 # Related reading: https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/
 [package.metadata.generate-rpm]
@@ -124,18 +115,4 @@ assets = [
     { source = "doc/manual/build/man/dnst-nsec3-hash.1", dest = "/usr/share/man/man1/dnst-nsec3-hash.1", mode = "644", doc = true },
     { source = "doc/manual/build/man/dnst-signzone.1", dest = "/usr/share/man/man1/dnst-signzone.1", mode = "644", doc = true },
     { source = "doc/manual/build/man/dnst-update.1", dest = "/usr/share/man/man1/dnst-update.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-key2ds.1", dest = "/usr/share/man/man1/ldns-key2ds.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-keygen.1", dest = "/usr/share/man/man1/ldns-keygen.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-notify.1", dest = "/usr/share/man/man1/ldns-notify.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-nsec3-hash.1", dest = "/usr/share/man/man1/ldns-nsec3-hash.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-signzone.1", dest = "/usr/share/man/man1/ldns-signzone.1", mode = "644", doc = true },
-    { source = "doc/manual/build/man/ldns-update.1", dest = "/usr/share/man/man1/ldns-update.1", mode = "644", doc = true },
 ]
-
-# These get set using cargo-generate-rpm --set-metadata at package build time.
-#post_trans_script = ...
-#post_uninstall_script = ...
-
-# Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
-[package.metadata.generate-rpm.obsoletes]
-ldns-utils = "< 0:1.8.4-2"
diff --git a/Dockerfile b/Dockerfile
index 603041e9..0d6637e3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -44,7 +44,7 @@ ARG MODE=build
 # ========
 #
 # Only used when MODE=build.
-ARG BASE_IMG=alpine:3.21
+ARG BASE_IMG=alpine:3.23
 
 
 # CARGO_ARGS
diff --git a/pkg/debian/postinst b/pkg/debian/postinst
index cb917632..accca133 100644
--- a/pkg/debian/postinst
+++ b/pkg/debian/postinst
@@ -2,12 +2,5 @@
 
 # case "$1" in
 # configure)
-#     # Create symbolic links
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-keygen
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-key2ds
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-nsec3-hash
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-notify
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-signzone
-#     ln -f -s /usr/bin/dnst /usr/bin/ldns-update
 #     ;;
 # esac
diff --git a/pkg/debian/prerm b/pkg/debian/prerm
index 552dbf84..23608b52 100644
--- a/pkg/debian/prerm
+++ b/pkg/debian/prerm
@@ -2,7 +2,5 @@
 
 # case "$1" in
 # upgrade|remove)
-#     # Remove symbolic links
-#     rm -f /usr/bin/ldns-nsec3-hash
 #     ;;
 # esac
diff --git a/pkg/dnst-ldnsutils/Cargo.lock b/pkg/dnst-ldnsutils/Cargo.lock
new file mode 100644
index 00000000..51792418
--- /dev/null
+++ b/pkg/dnst-ldnsutils/Cargo.lock
@@ -0,0 +1,7 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "dnst-ldnsutils"
+version = "0.2.0-alpha1"
diff --git a/pkg/dnst-ldnsutils/Cargo.toml b/pkg/dnst-ldnsutils/Cargo.toml
new file mode 100644
index 00000000..bc09909e
--- /dev/null
+++ b/pkg/dnst-ldnsutils/Cargo.toml
@@ -0,0 +1,54 @@
+[package]
+# This is a dummy program to build a separate package with ploutos
+name = "dnst-ldnsutils"
+version = "0.2.0-alpha1"
+edition = "2021"
+repository = "https://github.com/nlnetlabs/dnst/"
+authors = ["NLnet Labs <dns-team@nlnetlabs.nl>"]
+description = "Package for dnst's ldns symlinks and man pages"
+license = "BSD-3-Clause"
+
+[dependencies]
+
+# Related reading: https://wiki.debian.org/Teams/RustPackaging/Policy
+[package.metadata.deb]
+depends = "$auto, dnst"
+section = "net"
+priority = "optional"
+assets = [
+    # TODO: Extend Ploutos to generate the man pages from sources.
+    ["../../doc/manual/build/man/ldns-key2ds.1", "/usr/share/man/man1/ldns-key2ds.1", "644"],
+    ["../../doc/manual/build/man/ldns-keygen.1", "/usr/share/man/man1/ldns-keygen.1", "644"],
+    ["../../doc/manual/build/man/ldns-notify.1", "/usr/share/man/man1/ldns-notify.1", "644"],
+    ["../../doc/manual/build/man/ldns-nsec3-hash.1", "/usr/share/man/man1/ldns-nsec3-hash.1", "644"],
+    ["../../doc/manual/build/man/ldns-signzone.1", "/usr/share/man/man1/ldns-signzone.1", "644"],
+    ["../../doc/manual/build/man/ldns-update.1", "/usr/share/man/man1/ldns-update.1", "644"],
+]
+copyright = "Copyright (c) 2024, NLnet Labs. All rights reserved."
+extended-description = """\
+This is a meta package that replaces the original ldnsutils with their dnst
+counterparts (where implemented).
+"""
+maintainer-scripts = "pkg/debian"
+# See: https://www.debian.org/doc/debian-policy/ch-relationships.html#replacing-whole-packages-forcing-their-removal
+conflicts = "ldnsutils"
+replaces = "ldnsutils"
+
+# Related reading: https://docs.fedoraproject.org/en-US/packaging-guidelines/Rust/
+[package.metadata.generate-rpm]
+assets = [
+    # TODO: Extend Ploutos to generate the man pages from sources.
+    { source = "../../doc/manual/build/man/ldns-key2ds.1", dest = "/usr/share/man/man1/ldns-key2ds.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-keygen.1", dest = "/usr/share/man/man1/ldns-keygen.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-notify.1", dest = "/usr/share/man/man1/ldns-notify.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-nsec3-hash.1", dest = "/usr/share/man/man1/ldns-nsec3-hash.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-signzone.1", dest = "/usr/share/man/man1/ldns-signzone.1", mode = "644", doc = true },
+    { source = "../../doc/manual/build/man/ldns-update.1", dest = "/usr/share/man/man1/ldns-update.1", mode = "644", doc = true },
+]
+
+[package.metadata.generate-rpm.requires]
+dnst = "*"
+
+# Set Obsoletes per https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages.
+[package.metadata.generate-rpm.obsoletes]
+ldns-utils = "< 0:1.8.4-2"
diff --git a/pkg/dnst-ldnsutils/pkg/debian/postinst b/pkg/dnst-ldnsutils/pkg/debian/postinst
new file mode 100644
index 00000000..86017a67
--- /dev/null
+++ b/pkg/dnst-ldnsutils/pkg/debian/postinst
@@ -0,0 +1,13 @@
+#!/bin/sh -e
+
+case "$1" in
+configure)
+    # Create symbolic links
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-keygen
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-key2ds
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-nsec3-hash
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-notify
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-signzone
+    ln -f -s /usr/bin/dnst /usr/bin/ldns-update
+    ;;
+esac
diff --git a/pkg/dnst-ldnsutils/pkg/debian/prerm b/pkg/dnst-ldnsutils/pkg/debian/prerm
new file mode 100644
index 00000000..1575418c
--- /dev/null
+++ b/pkg/dnst-ldnsutils/pkg/debian/prerm
@@ -0,0 +1,13 @@
+#!/bin/sh -e
+
+case "$1" in
+upgrade|remove)
+    # Remove symbolic links
+    rm -f /usr/bin/ldns-keygen
+    rm -f /usr/bin/ldns-key2ds
+    rm -f /usr/bin/ldns-nsec3-hash
+    rm -f /usr/bin/ldns-notify
+    rm -f /usr/bin/ldns-signzone
+    rm -f /usr/bin/ldns-update
+    ;;
+esac
diff --git a/pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml b/pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml
new file mode 100644
index 00000000..1313d817
--- /dev/null
+++ b/pkg/dnst-ldnsutils/pkg/rpm/scriptlets.toml
@@ -0,0 +1,39 @@
+post_trans_script = '''
+#!/bin/bash -e
+
+# This script will be run _after_ upgrade in the presence of an obsoleted ldns-utils
+# package. This is useful because the ldns-utils uninstall script will have been run
+# _after_ installation of dnst and so the symbolic links that we create will be
+# removed, and we have to make sure here that they get put back
+
+FORCE=
+# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
+if [ $1 -eq 2 ]; then
+    # Upgrade
+    FORCE=-f
+fi
+
+# Create symbolic links
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-keygen
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-key2ds
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-nsec3-hash
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-notify
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-signzone
+ln -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-update
+'''
+
+post_uninstall_script = '''
+#!/bin/bash -e
+
+# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
+if [ $1 -eq 0 ] ; then
+    # Uninstallation
+    # Remove symbolic links
+    rm -f /usr/bin/ldns-keygen
+    rm -f /usr/bin/ldns-key2ds
+    rm -f /usr/bin/ldns-nsec3-hash
+    rm -f /usr/bin/ldns-notify
+    rm -f /usr/bin/ldns-signzone
+    rm -f /usr/bin/ldns-update
+fi
+'''
diff --git a/pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml b/pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml
new file mode 100644
index 00000000..dcf9ee7a
--- /dev/null
+++ b/pkg/dnst-ldnsutils/pkg/rules/packages-to-build.yml
@@ -0,0 +1,41 @@
+# This matrix definition is used as both the package_build_rules and the package_test_rules Ploutos packaging
+# workflow inputs.
+---
+pkg:
+  - 'dnst-ldnsutils'
+image:
+  - "ubuntu:jammy"    # ubuntu/22.04
+  - "ubuntu:noble"    # ubuntu/24.04
+  - "debian:bullseye" # debian/11
+  - "debian:bookworm" # debian/12
+  - "debian:trixie"   # debian/13
+  - 'almalinux:8'     # compatible with EOL centos:8
+  - 'almalinux:9'
+  - 'almalinux:10'
+target:
+  - 'x86_64'
+include:
+  # package for the Raspberry Pi 4b as an ARMv7 cross compiled variant of the Debian Bullseye upon which
+  # Raspbian 11 is based.
+  - pkg: 'dnst-ldnsutils'
+    image: 'debian:bullseye'
+    target: 'armv7-unknown-linux-musleabihf'
+
+  # package for the Raspberry Pi 1b as an ARMv6 cross compiled variant of the Debian Buster upon which
+  # Raspbian 10 is based.
+  - pkg: 'dnst-ldnsutils'
+    image: 'debian:buster'
+    target: 'arm-unknown-linux-musleabihf'
+
+  # package for the ROCK64 as an AARCH64 cross compiled variant of Debian Buster upon which Armbian 21 is based.
+  - pkg: 'dnst-ldnsutils'
+    image: 'debian:buster'
+    target: 'aarch64-unknown-linux-musl'
+
+  # Set rpmlint filters for RHEL rpmlint
+  - image: 'almalinux:8'
+    rpm_rpmlint_check_filters: no-binary
+  - image: 'almalinux:9'
+    rpm_rpmlint_check_filters: no-binary
+  - image: 'almalinux:10'
+    rpm_rpmlint_check_filters: no-binary
diff --git a/pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml b/pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml
new file mode 100644
index 00000000..b93ffdb9
--- /dev/null
+++ b/pkg/dnst-ldnsutils/pkg/rules/packages-to-test.yml
@@ -0,0 +1,63 @@
+# This matrix definition is used as both the package_build_rules and the package_test_rules Ploutos packaging
+# workflow inputs.
+---
+pkg:
+  - 'dnst-ldnsutils'
+image:
+  - "ubuntu:jammy"    # ubuntu/22.04
+  - "ubuntu:noble"    # ubuntu/24.04
+  - "debian:bullseye" # debian/11
+  - "debian:bookworm" # debian/12
+  - "debian:trixie"   # debian/13
+published_pkg:
+  - 'ldnsutils'       # correct for Ubuntu/Debian
+target:
+  - 'x86_64'
+test-image:
+  # Set 'test-image' to the empty string for all matrix permutations so that the default ('image') will be used
+  # to launch an LXC container to test the created packages in. Why explicitly set what is already the default?
+  # If this isn't present, later entries in the include set below will overwrite earlier entries that differ
+  # only by their 'test-image' value. If however 'test-image' is present in the original matrix by defining it
+  # here, then 'included' entries will no longer overwrite each other because they alter a key that is present
+  # in the original matrix. This is just how GitHub Actions matrix include rules work.
+  - ""
+test-mode:   
+  - 'fresh-install'
+  - 'upgrade-from-published'
+include:
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:8'
+    target: 'x86_64'
+    test-mode: 'fresh-install'
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:8'
+    target: 'x86_64'
+    test-mode: 'upgrade-from-published'
+    published_pkg: 'ldns-utils'
+    rpm_yum_extra_args: --enablerepo powertools
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:9'
+    target: 'x86_64'
+    test-mode: 'fresh-install'
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:9'
+    target: 'x86_64'
+    test-mode: 'upgrade-from-published'
+    published_pkg: 'ldns-utils'
+    rpm_yum_extra_args: --enablerepo crb
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:10'
+    target: 'x86_64'
+    test-mode: 'fresh-install'
+
+  - pkg: 'dnst-ldnsutils'
+    image: 'almalinux:10'
+    target: 'x86_64'
+    test-mode: 'upgrade-from-published'
+    published_pkg: 'ldns-utils'
+    # --enablerepo crb is no longer needed since alma10 (https://almalinux.org/blog/2025-09-08-enabling-crb-by-default-for-almalinux10/)
+    # rpm_yum_extra_args: --enablerepo crb
diff --git a/pkg/dnst-ldnsutils/pkg/test-scripts/test-dnst-ldnsutils.sh b/pkg/dnst-ldnsutils/pkg/test-scripts/test-dnst-ldnsutils.sh
new file mode 100644
index 00000000..9e70ca3f
--- /dev/null
+++ b/pkg/dnst-ldnsutils/pkg/test-scripts/test-dnst-ldnsutils.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+set -x
+
+case $1 in
+  post-install)
+    # Run some sanity checks
+    ldns-keygen -v
+    ldns-nsec3-hash nlnetlabs.nl
+    man ldns-keygen
+    ;;
+
+  post-upgrade)
+    # Nothing to do.
+    # Run some sanity checks
+    ldns-keygen -v
+    ldns-nsec3-hash nlnetlabs.nl
+    man ldns-keygen
+    ;;
+esac
diff --git a/pkg/dnst-ldnsutils/src/main.rs b/pkg/dnst-ldnsutils/src/main.rs
new file mode 100644
index 00000000..f328e4d9
--- /dev/null
+++ b/pkg/dnst-ldnsutils/src/main.rs
@@ -0,0 +1 @@
+fn main() {}
diff --git a/pkg/rpm/scriptlets.toml b/pkg/rpm/scriptlets.toml
index 838ec664..44717267 100644
--- a/pkg/rpm/scriptlets.toml
+++ b/pkg/rpm/scriptlets.toml
@@ -1,38 +1,19 @@
 post_trans_script = '''
 #!/bin/bash -e
 
-# # This script will be run _after_ upgrade in the presence of an obsoleted ldns-utils
-# # package. This is useful because the ldns-utils uninstall script will have been run
-# # _after_ installation of dnst and so the symbolic links that we create will be
-# # removed, and we have to make sure here that they get put back
-# 
 # FORCE=
-# # See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
+# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
 # if [ $1 -eq 2 ]; then
 #     # Upgrade
 #     FORCE=-f
 # fi
-# 
-# # Create symbolic links
-# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-keygen
-# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-key2ds
-# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-nsec3-hash
-# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-notify
-# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-signzone
-# ln -f -s ${FORCE} /usr/bin/dnst /usr/bin/ldns-update
 '''
 
 post_uninstall_script = '''
 #!/bin/bash -e
-# # See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
+
+# See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
 # if [ $1 -eq 0 ] ; then
 #     # Uninstallation
-#     # Remove symbolic links
-#     rm -f /usr/bin/ldns-keygen
-#     rm -f /usr/bin/ldns-key2ds
-#     rm -f /usr/bin/ldns-nsec3-hash
-#     rm -f /usr/bin/ldns-notify
-#     rm -f /usr/bin/ldns-signzone
-#     rm -f /usr/bin/ldns-update
 # fi
 '''
diff --git a/pkg/rules/packages-to-build.yml b/pkg/rules/packages-to-build.yml
index e37f8092..8bb84b60 100644
--- a/pkg/rules/packages-to-build.yml
+++ b/pkg/rules/packages-to-build.yml
@@ -2,12 +2,10 @@
 # workflow inputs.
 ---
 pkg:
-  - 'cascade-dnst'
+  - 'dnst'
 image:
-  - "ubuntu:focal"    # ubuntu/20.04
   - "ubuntu:jammy"    # ubuntu/22.04
   - "ubuntu:noble"    # ubuntu/24.04
-  - "debian:buster"   # debian/10
   - "debian:bullseye" # debian/11
   - "debian:bookworm" # debian/12
   - "debian:trixie"   # debian/13
@@ -19,17 +17,17 @@ target:
 include:
   # package for the Raspberry Pi 4b as an ARMv7 cross compiled variant of the Debian Bullseye upon which
   # Raspbian 11 is based.
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'debian:bullseye'
     target: 'armv7-unknown-linux-musleabihf'
 
   # package for the Raspberry Pi 1b as an ARMv6 cross compiled variant of the Debian Buster upon which
   # Raspbian 10 is based.
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'debian:buster'
     target: 'arm-unknown-linux-musleabihf'
 
   # package for the ROCK64 as an AARCH64 cross compiled variant of Debian Buster upon which Armbian 21 is based.
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'debian:buster'
     target: 'aarch64-unknown-linux-musl'
diff --git a/pkg/rules/packages-to-test.yml b/pkg/rules/packages-to-test.yml
index 885bfc61..2a6b6ff7 100644
--- a/pkg/rules/packages-to-test.yml
+++ b/pkg/rules/packages-to-test.yml
@@ -2,12 +2,10 @@
 # workflow inputs.
 ---
 pkg:
-  - 'cascade-dnst'
+  - 'dnst'
 image:
-  - "ubuntu:focal"    # ubuntu/20.04
   - "ubuntu:jammy"    # ubuntu/22.04
   - "ubuntu:noble"    # ubuntu/24.04
-  - "debian:buster"   # debian/10
   - "debian:bullseye" # debian/11
   - "debian:bookworm" # debian/12
   - "debian:trixie"   # debian/13
@@ -27,48 +25,39 @@ test-mode:
   - 'fresh-install'
   - 'upgrade-from-published'
 include:
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'almalinux:8'
     target: 'x86_64'
     test-mode: 'fresh-install'
 
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'almalinux:8'
     target: 'x86_64'
     test-mode: 'upgrade-from-published'
     published_pkg: 'ldns-utils'
     rpm_yum_extra_args: --enablerepo powertools
 
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'almalinux:9'
     target: 'x86_64'
     test-mode: 'fresh-install'
 
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'almalinux:9'
     target: 'x86_64'
     test-mode: 'upgrade-from-published'
     published_pkg: 'ldns-utils'
     rpm_yum_extra_args: --enablerepo crb
 
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'almalinux:10'
     target: 'x86_64'
     test-mode: 'fresh-install'
 
-  - pkg: 'cascade-dnst'
+  - pkg: 'dnst'
     image: 'almalinux:10'
     target: 'x86_64'
     test-mode: 'upgrade-from-published'
     published_pkg: 'ldns-utils'
-    rpm_yum_extra_args: --enablerepo crb
-
-# Disable upgrade testing on Rocky Linux 9 and Debian Bookworm as we haven't published any packages for
-# those O/S versions yet.
-#test-exclude:
-#  - pkg: 'routinator'
-#    image: 'rockylinux:9'
-#    mode: 'upgrade-from-published'
-#  - pkg: 'routinator'
-#    image: 'debian:bookworm'
-#    mode: 'upgrade-from-published'
+    # --enablerepo crb is no longer needed since alma10 (https://almalinux.org/blog/2025-09-08-enabling-crb-by-default-for-almalinux10/)
+    # rpm_yum_extra_args: --enablerepo crb
diff --git a/pkg/test-scripts/test-cascade-dnst.sh b/pkg/test-scripts/test-cascade-dnst.sh
deleted file mode 100644
index b1e2a2d2..00000000
--- a/pkg/test-scripts/test-cascade-dnst.sh
+++ /dev/null
@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-
-set -eo pipefail
-set -x
-
-case $1 in
-  post-install)
-    # Run some sanity checks
-    /usr/libexec/cascade/cascade-dnst --version
-    # ldns-keygen -v
-    # dnst nsec3-hash nlnetlabs.nl
-    # ldns-nsec3-hash nlnetlabs.nl
-    /usr/libexec/cascade/cascade-dnst keyset --help
-    man cascade-dnst
-    # man dnst-keygen
-    # man ldns-keygen
-    man cascade-dnst-keyset
-    ;;
-
-  post-upgrade)
-    # Nothing to do.
-    # Run some sanity checks
-    /usr/libexec/cascade/cascade-dnst --version
-    # ldns-keygen -v
-    # dnst nsec3-hash nlnetlabs.nl
-    # ldns-nsec3-hash nlnetlabs.nl
-    /usr/libexec/cascade/cascade-dnst keyset --help
-    man cascade-dnst
-    # man dnst
-    # man dnst-keygen
-    # man ldns-keygen
-    man cascade-dnst-keyset
-    ;;
-esac
diff --git a/pkg/test-scripts/test-dnst.sh b/pkg/test-scripts/test-dnst.sh
new file mode 100644
index 00000000..89eb0414
--- /dev/null
+++ b/pkg/test-scripts/test-dnst.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+set -x
+
+case $1 in
+  post-install)
+    # Run some sanity checks
+    dnst --version
+    dnst nsec3-hash nlnetlabs.nl
+    man dnst
+    man dnst-keygen
+    ;;
+
+  post-upgrade)
+    # Nothing to do.
+    # Run some sanity checks
+    dnst --version
+    dnst nsec3-hash nlnetlabs.nl
+    man dnst
+    man dnst-keygen
+    ;;
+esac