diff --git a/NEWS b/NEWS
index 113161bf2b99216926b0e9b381e84bea3d82c6c5..cf37e47729f46dceb1a7e4c1d935f9acd8978b1c 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,7 @@
 unreleased (207x-xx-xx)
 
+    [wallet] Make wallet ketyab use the correct path for ktutil.
+
     [duo] Change apt pin file to point to codename rather than archive
     name. [adamhl]
 
diff --git a/manifests/wallet/keytab.pp b/manifests/wallet/keytab.pp
index 18c8ec7cb9430a25f90aa44dd82a30ef354b540c..893e1beba63c4a9737f057461913e44c5f514666 100644
--- a/manifests/wallet/keytab.pp
+++ b/manifests/wallet/keytab.pp
@@ -8,12 +8,19 @@ define base::wallet::keytab(
   $heimdal = false
 ) {
   include base::wallet::client
+
+  if ($::lsbdistcodename == 'wheezy') {
+    $ktutil_exe = '/usr/sbin/ktutil'
+  } else {
+    $ktutil_exe = '/usr/bin/ktutil'
+  }
+
   $wallet_opts = "-f '$path' get keytab '$name'"
   exec { "wallet $wallet_opts":
     path    => '/bin:/usr/bin:/usr/local/bin:/usr/kerberos/bin',
     command => "${kstart_cmd} wallet ${wallet_opts}",
     unless  => $heimdal ? {
-      true  => "/usr/sbin/ktutil -k '$path' list | grep -i -q '$name'",
+      true  => "${ktutil_exe} -k '$path' list | grep -i -q '$name'",
       false => "klist -k '$path' | grep -i -q '$name'",
     },
     require => [ Package['kstart'], Package['wallet-client'] ],