diff --git a/debian/changelog b/debian/changelog
index 0a54dfe..d4fc461 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,6 +1,7 @@
 ognibuild (0.0.2-2) UNRELEASED; urgency=medium
 
   * Add missing dependency on python3-lz4.
+  * Set upstream metadata fields: Security-Contact.
 
  -- Jelmer Vernooij <jelmer@debian.org>  Wed, 03 Mar 2021 16:42:28 +0000
 
diff --git a/debian/upstream/metadata b/debian/upstream/metadata
index 5bcc1f3..6a60ea0 100644
--- a/debian/upstream/metadata
+++ b/debian/upstream/metadata
@@ -3,3 +3,4 @@ Bug-Database: https://github.com/jelmer/ognibuild/issues
 Bug-Submit: https://github.com/jelmer/ognibuild/issues/new
 Repository: https://github.com/jelmer/ognibuild.git
 Repository-Browse: https://github.com/jelmer/ognibuild
+Security-Contact: https://github.com/jelmer/ognibuild/tree/HEAD/SECURITY.md