diff --git a/packages/README.md b/packages/README.md
index 79a17336..a6095f45 100644
--- a/packages/README.md
+++ b/packages/README.md
@@ -11,7 +11,7 @@ directory each, with its own changelog and version, released on its own
 | --- | --- | --- | --- |
 | `installer/` | `keel-overlay-installer` | Keel's `inithooks` (>= 2.3.6+keel14), `confconsole` (>= 2.2.3+keel8), `keel` (>= 0.12.0) | none; its manifest names the first boot hooks the three ship |
 | `wireguard/` | `keel-overlay-wireguard` | trixie's `wireguard-tools` 1.0.20210914 | none; the interface is the instance spec's |
-| `etcd/` | `keel-overlay-etcd` | trixie's `etcd-server` 3.5.16, `keel` (>= 0.21.0), whose gate its drop-in runs, and `keel-overlay-wireguard`, which its manifest `requires` | `etcd.service`, and its drop-in `keel-overlay-etcd.conf`: one member restarts at a time |
+| `etcd/` | `keel-overlay-etcd` | trixie's `etcd-server` 3.5.16 and its `etcd-client` (etcdctl, which keel asks etcd with over gRPC, keel#83), both bounded to that upstream release, `keel` (>= 0.21.0), whose gate its drop-in runs (keel 0.22.0 asks etcd with the etcdctl this brings), and `keel-overlay-wireguard`, which its manifest `requires` | `etcd.service`, and its drop-in `keel-overlay-etcd.conf`: one member restarts at a time |
 | `vip/` | `keel-overlay-vip` | `keel` (>= 0.21.0), whose `keel vip` the units run, and `keel-overlay-wireguard`, which its manifest `requires` | `keel-vip.service`, the VIP's root helper with etcd, which starts its unprivileged controller as the transient `keel-vip-control`; and `keel-vip-check.timer`, part of it |
 | `crowdsec/` | `keel-overlay-crowdsec` | trixie's `crowdsec` 1.4.6-10 and `crowdsec-firewall-bouncer` 0.0.25 | `crowdsec.service`, `crowdsec-firewall-bouncer.service` |
 | `nginx/` | `keel-overlay-nginx` | trixie's `nginx` 1.26.3 and `libnginx-mod-stream` | `nginx.service`, enabled in every mode |
diff --git a/packages/etcd/debian/changelog b/packages/etcd/debian/changelog
index 9551e0df..930b1611 100644
--- a/packages/etcd/debian/changelog
+++ b/packages/etcd/debian/changelog
@@ -1,3 +1,18 @@
+keel-overlay-etcd (0.4.0) trixie; urgency=medium
+
+  * Depends on etcd-client, the same upstream version as etcd-server
+    (3.5.16; both from Debian's etcd source, so the binary versions can
+    not be tied with ${source:Version} from this package's source, and
+    both are bounded to that upstream release instead): keel asks etcd
+    with etcdctl over gRPC, the only way etcd takes a client
+    certificate's CN as its user, and turns etcd's JSON gateway off
+    (Keel-Linux/keel#83). A newer etcd upstream is a deliberate update
+    of this package.
+  * keel (>= 0.21.0) stays: an older keel runs beside etcdctl unused, and
+    the keel that asks with it (0.22.0) Breaks the overlays before this.
+
+ -- Marcos Mendez <mendez.foto@gmail.com>  Thu, 08 Oct 2026 16:00:00 +0000
+
 keel-overlay-etcd (0.3.0) trixie; urgency=medium
 
   * etcd restarted one member at a time (the maintainer's requirement of
diff --git a/packages/etcd/debian/control b/packages/etcd/debian/control
index f79f19c4..2056f440 100644
--- a/packages/etcd/debian/control
+++ b/packages/etcd/debian/control
@@ -13,14 +13,18 @@ Vcs-Browser: https://github.com/Keel-Linux/common/tree/19.x/packages/etcd
 Package: keel-overlay-etcd
 Architecture: all
 Depends:
+ etcd-client (>= 3.5.16),
+ etcd-client (<< 3.5.17~),
  etcd-server (>= 3.5.16),
+ etcd-server (<< 3.5.17~),
  keel (>= 0.21.0),
  keel-overlay-wireguard,
  ${misc:Depends},
 Description: Keel overlay: etcd, the mesh registry
  The etcd overlay of Keel Linux (handbook decisions 0025 and 0036): trixie's
- etcd-server, and the overlay manifest keel reads, installed as
- /usr/share/keel/overlays/etcd.yaml (decision 0041).
+ etcd-server, its etcdctl (etcd-client, the same upstream version), which
+ keel asks etcd with over gRPC (keel#83), and the overlay manifest keel
+ reads, installed as /usr/share/keel/overlays/etcd.yaml (decision 0041).
  .
  etcd is installed disabled and stopped, the state of a simple
  installation: the first installation of this package disables the unit
diff --git a/tests/overlay-install.bats b/tests/overlay-install.bats
index fa79e74c..95202242 100644
--- a/tests/overlay-install.bats
+++ b/tests/overlay-install.bats
@@ -298,6 +298,18 @@ assert_simple_state() {
     [ "$output" != active ]
 }
 
+@test "etcdctl comes with the etcd overlay, from etcd-server's source version" {
+    # keel asks etcd with etcdctl over gRPC (Keel-Linux/keel#83)
+    command -v etcdctl
+    run dpkg-query -W -f='${source:Package} ${source:Version}' etcd-client
+    [ "$status" -eq 0 ]
+    local client="$output"
+    run dpkg-query -W -f='${source:Package} ${source:Version}' etcd-server
+    [ "$status" -eq 0 ]
+    echo "etcd-client: $client; etcd-server: $output"
+    [ "$client" = "$output" ]
+}
+
 @test "the VIP check timer is not enabled and not running: it belongs to the controller" {
     run systemctl is-enabled keel-vip-check.timer
     echo "$output"