diff --git a/debian/changelog b/debian/changelog
index 1f7848d16c28f6c07b1ed92b21ab4726be110ad5..b16e1a956f7eeb5e97d8390cab8560691760e27e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -2,6 +2,7 @@ golang-github-git-lfs-gitobj (2.1.0-2) UNRELEASED; urgency=medium
 
   * Remove constraints unnecessary since buster:
     + Build-Depends: Drop versioned constraint on golang-any.
+  * Set upstream metadata fields: Security-Contact.
 
  -- Debian Janitor <janitor@jelmer.uk>  Mon, 25 Apr 2022 03:19:08 -0000
 
diff --git a/debian/upstream/metadata b/debian/upstream/metadata
index fe488e4a06b0f0e4dad32b0880c411332bcc892b..36f32f2d9e2627724e62d5168611ac1507f0838c 100644
--- a/debian/upstream/metadata
+++ b/debian/upstream/metadata
@@ -3,3 +3,4 @@ Bug-Database: https://github.com/git-lfs/gitobj/issues
 Bug-Submit: https://github.com/git-lfs/gitobj/issues/new
 Repository: https://github.com/git-lfs/gitobj.git
 Repository-Browse: https://github.com/git-lfs/gitobj
+Security-Contact: https://github.com/git-lfs/gitobj/tree/HEAD/SECURITY.md