diff --git a/CHANGES b/CHANGES
index 857353d07f..18384ccd9f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,9 @@
 	--- 9.11.0rc1 released ---
 
+4452.	[bug]		The default key manager policy file is now
+			<sysdir>/dnssec-policy.conf (usually
+			/etc/dnssec-policy.conf). [RT #43064]
+
 4451.   [cleanup]       Log more useful information if a PKCS#11 provider
                         library cannot be loaded. [RT #43076]
 
diff --git a/bin/python/dnssec-keymgr.docbook b/bin/python/dnssec-keymgr.docbook
index 86a1cbc430..685b0730ad 100644
--- a/bin/python/dnssec-keymgr.docbook
+++ b/bin/python/dnssec-keymgr.docbook
@@ -60,7 +60,7 @@
     </para>
     <para>
       DNSSEC policy can be read from a configuration file (default
-      <filename>/etc/dnssec.policy</filename>), from which the key
+      <filename>/etc/dnssec-policy.conf</filename>), from which the key
       parameters, publication and rollover schedule, and desired
       coverage duration for any given zone can be determined.  This
       file may be used to define individual DNSSEC policies on a
@@ -109,7 +109,7 @@
             If <option>-c</option> is specified, then the DNSSEC
             policy is read from <option>file</option>.  (If not
             specified, then the policy is read from
-            <filename>/etc/policy.conf</filename>; if that file
+            <filename>/etc/dnssec-policy.conf</filename>; if that file
             doesn't exist, a built-in global default policy is used.)
           </para>
         </listitem>
@@ -228,7 +228,7 @@
 
   <refsection><info><title>POLICY CONFIGURATION</title></info>
     <para>
-      The <filename>policy.conf</filename> file can specify three kinds
+      The <filename>dnssec-policy.conf</filename> file can specify three kinds
       of policies:
     </para>
     <itemizedlist>
diff --git a/bin/python/isc/keymgr.py.in b/bin/python/isc/keymgr.py.in
index 702f1ace6c..98c003f8e2 100644
--- a/bin/python/isc/keymgr.py.in
+++ b/bin/python/isc/keymgr.py.in
@@ -109,7 +109,8 @@ def parse_args():
         if not os.path.exists(args.policyfile):
             fatal('ERROR: Policy file "%s" not found' % args.policyfile)
     else:
-        args.policyfile = os.path.join(utils.sysconfdir, 'policy.conf')
+        args.policyfile = os.path.join(utils.sysconfdir,
+                                       'dnssec-policy.conf')
         if not os.path.exists(args.policyfile):
             args.policyfile = None