diff --git a/debian/changelog b/debian/changelog
index 0a40f5e..1f668a3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+shim-signed (1.42) unstable; urgency=medium
+
+  * Tweak versioning in runtime dependencies, using substvars
+    to make things more automatic in future.
+
+ -- Steve McIntyre <93sam@debian.org>  Fri, 28 Jun 2024 00:40:31 +0100
+
 shim-signed (1.41) unstable; urgency=medium
 
   * Build against new signed binaries corresponding to 15.8-1
diff --git a/debian/control b/debian/control
index 19a4fd6..b72c0c1 100644
--- a/debian/control
+++ b/debian/control
@@ -20,9 +20,9 @@ Multi-Arch: same
 Depends: ${misc:Depends},
  shim-signed-common (>= ${source:Version}),
  grub-efi-amd64-bin [amd64],
- shim-helpers-amd64-signed (>= 1+15.4+2) [amd64],
+ shim-helpers-amd64-signed (>= ${helpers:Version}) [amd64],
  grub-efi-arm64-bin [arm64],
- shim-helpers-arm64-signed (>= 1+15.4+2) [arm64],
+ shim-helpers-arm64-signed (>= ${helpers:Version}) [arm64],
  grub2-common (>= 2.06-6)
 Built-Using: shim (= ${shim:Version})
 Description: Secure Boot chain-loading bootloader (Microsoft-signed binary)
diff --git a/debian/rules b/debian/rules
index 91ea525..f45b53e 100755
--- a/debian/rules
+++ b/debian/rules
@@ -2,6 +2,7 @@
 
 VERSION := $(shell LC_ALL=C dpkg-parsechangelog | grep ^Version: | cut -d ' ' -f 2)
 SHIM_VERSION := $(shell dpkg-query -f '$${Version}\n' -W shim-unsigned)
+SHIM_HELPERS_VERSION := $(shell dpkg-query -f '$${Version}\n' -W 'shim-helpers-*-signed')
 VENDOR := $(shell dpkg-vendor --query vendor)
 
 include /usr/share/dpkg/architecture.mk
@@ -33,4 +34,6 @@ endif
 
 override_dh_gencontrol:
 	dh_gencontrol -- -v$(VERSION)+$(SHIM_VERSION) \
-		-Vshim:Version=$(SHIM_VERSION)
+		-Vshim:Version=$(SHIM_VERSION) \
+		-Vhelpers:Version=$(SHIM_HELPERS_VERSION)
+