diff --git a/recipes-security/refpolicy/refpolicy_common.inc b/recipes-security/refpolicy/refpolicy_common.inc
index 6ea1fc2..000fb3c 100644
--- a/recipes-security/refpolicy/refpolicy_common.inc
+++ b/recipes-security/refpolicy/refpolicy_common.inc
@@ -214,12 +214,12 @@ EOF
 }
 
 install_misc_files() {
-    cat ${WORKDIR}/customizable_types >> \
+    cat ${UNPACKDIR}/customizable_types >> \
         ${D}${sysconfdir}/selinux/${POLICY_NAME}/contexts/customizable_types
 
     # Install setrans.conf for mls/mcs policy
-    if [ -f ${WORKDIR}/setrans-${POLICY_TYPE}.conf ]; then
-        install -m 0644 ${WORKDIR}/setrans-${POLICY_TYPE}.conf \
+    if [ -f ${UNPACKDIR}/setrans-${POLICY_TYPE}.conf ]; then
+        install -m 0644 ${UNPACKDIR}/setrans-${POLICY_TYPE}.conf \
             ${D}${sysconfdir}/selinux/${POLICY_NAME}/setrans.conf
     fi
 
diff --git a/recipes-security/selinux-scripts/selinux-initsh.inc b/recipes-security/selinux-scripts/selinux-initsh.inc
index f6a3d85..efe7e88 100644
--- a/recipes-security/selinux-scripts/selinux-initsh.inc
+++ b/recipes-security/selinux-scripts/selinux-initsh.inc
@@ -1,4 +1,6 @@
-S ?= "${WORKDIR}"
+S ?= "${WORKDIR}/sources"
+UNPACKDIR = "${S}"
+
 SECTION ?= "base"
 
 # Default is for script name to be the same as the recipe name.
@@ -21,17 +23,17 @@ FILES:${PN} += "/.autorelabel"
 
 do_install () {
 	install -d ${D}${sysconfdir}/init.d/
-	install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
+	install -m 0755 ${S}/${SELINUX_SCRIPT_SRC}.sh ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
 	# Insert the relabelling code which is only needed with sysvinit
-	sed -i -e '/HERE/r ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh.sysvinit' \
+	sed -i -e '/HERE/r ${S}/${SELINUX_SCRIPT_SRC}.sh.sysvinit' \
 	       -e '/.*HERE$/d' -e '/.*Contents.*sysvinit/d' \
 	       ${D}${sysconfdir}/init.d/${SELINUX_SCRIPT_DST}
 
     if ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'true', 'false', d)}; then
         install -d ${D}${systemd_unitdir}/system
-        install -m 0644 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
+        install -m 0644 ${S}/${SELINUX_SCRIPT_SRC}.service ${D}${systemd_unitdir}/system
         install -d ${D}${bindir}
-        install -m 0755 ${WORKDIR}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
+        install -m 0755 ${S}/${SELINUX_SCRIPT_SRC}.sh ${D}${bindir}
         sed -i -e '/.*HERE$/d' ${D}${bindir}/${SELINUX_SCRIPT_SRC}.sh
     fi
 }
diff --git a/recipes-security/selinux/policycoreutils_3.6.bb b/recipes-security/selinux/policycoreutils_3.6.bb
index c106ee7..2871de0 100644
--- a/recipes-security/selinux/policycoreutils_3.6.bb
+++ b/recipes-security/selinux/policycoreutils_3.6.bb
@@ -166,9 +166,9 @@ do_install:class-native() {
 }
 
 do_install:append:class-target() {
-    if [ -e ${WORKDIR}/pam.d ]; then
+    if [ -e ${UNPACKDIR}/pam.d ]; then
         install -d ${D}${sysconfdir}/pam.d/
-        install -m 0644 ${WORKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
+        install -m 0644 ${UNPACKDIR}/pam.d/* ${D}${sysconfdir}/pam.d/
     fi
 
     # /var/lib/selinux is involved by seobject.py: