diff --git a/apparmor.d/abstractions/app/editor b/apparmor.d/abstractions/app/editor
index f62e36339..2bd14077b 100644
--- a/apparmor.d/abstractions/app/editor
+++ b/apparmor.d/abstractions/app/editor
@@ -13,7 +13,7 @@
   @{bin}/nvim                mrix,
   @{bin}/sensible-editor       mr,
   @{bin}/vim{,.*}            mrix,
-  @{bin}/which                rix,
+  @{bin}/which{,.debianutils} rix,
 
   /usr/share/nvim/{,**} r,
   /usr/share/terminfo/** r,
diff --git a/apparmor.d/groups/apt/apt-systemd-daily b/apparmor.d/groups/apt/apt-systemd-daily
index bd2f7fbb0..4f0d4e36b 100644
--- a/apparmor.d/groups/apt/apt-systemd-daily
+++ b/apparmor.d/groups/apt/apt-systemd-daily
@@ -37,7 +37,7 @@ profile apt-systemd-daily @{exec_path} {
   @{bin}/touch      rix,
   @{bin}/uniq       rix,
   @{bin}/wc         rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/xargs      rix,
 
   @{bin}/apt-config         rPx,
diff --git a/apparmor.d/groups/apt/aptitude-create-state-bundle b/apparmor.d/groups/apt/aptitude-create-state-bundle
index 59f7a54f6..a2f5e2050 100644
--- a/apparmor.d/groups/apt/aptitude-create-state-bundle
+++ b/apparmor.d/groups/apt/aptitude-create-state-bundle
@@ -16,7 +16,7 @@ profile aptitude-create-state-bundle @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tar        rix,
   @{bin}/bzip2      rix,
   @{bin}/gzip       rix,
diff --git a/apparmor.d/groups/browsers/brave-wrapper b/apparmor.d/groups/browsers/brave-wrapper
index 7001da3fe..b4f70689c 100644
--- a/apparmor.d/groups/browsers/brave-wrapper
+++ b/apparmor.d/groups/browsers/brave-wrapper
@@ -23,7 +23,7 @@ profile brave-wrapper @{exec_path} {
   @{bin}/mkdir                 rix,
   @{bin}/readlink              rix,
   @{bin}/touch                 rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{lib_dirs}/brave rPx,
 
diff --git a/apparmor.d/groups/browsers/chrome-wrapper b/apparmor.d/groups/browsers/chrome-wrapper
index 0a97d4052..709eb79a1 100644
--- a/apparmor.d/groups/browsers/chrome-wrapper
+++ b/apparmor.d/groups/browsers/chrome-wrapper
@@ -22,7 +22,7 @@ profile chrome-wrapper @{exec_path} flags=(attach_disconnected) {
   @{bin}/mkdir                 rix,
   @{bin}/readlink              rix,
   @{bin}/touch                 rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{lib_dirs}/chrome   rPx,
 
diff --git a/apparmor.d/groups/browsers/msedge-wrapper b/apparmor.d/groups/browsers/msedge-wrapper
index 3da31e332..8268db2e1 100644
--- a/apparmor.d/groups/browsers/msedge-wrapper
+++ b/apparmor.d/groups/browsers/msedge-wrapper
@@ -22,7 +22,7 @@ profile msedge-wrapper @{exec_path} flags=(attach_disconnected) {
   @{bin}/mkdir                 rix,
   @{bin}/readlink              rix,
   @{bin}/touch                 rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{lib_dirs}/msedge   rPx,
 
diff --git a/apparmor.d/groups/cron/cron-apt-compat b/apparmor.d/groups/cron/cron-apt-compat
index 1778d4b7e..fcf5e4430 100644
--- a/apparmor.d/groups/cron/cron-apt-compat
+++ b/apparmor.d/groups/cron/cron-apt-compat
@@ -22,7 +22,7 @@ profile cron-apt-compat @{exec_path} {
   @{bin}/dd                    rix,
   @{bin}/cksum                 rix,
   @{bin}/cut                   rix,
-  @{bin}/which                 rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/sleep                 rix,
 
   include if exists <local/cron-apt-compat>
diff --git a/apparmor.d/groups/cron/cron-apt-xapian-index b/apparmor.d/groups/cron/cron-apt-xapian-index
index 83eb22428..15f93efec 100644
--- a/apparmor.d/groups/cron/cron-apt-xapian-index
+++ b/apparmor.d/groups/cron/cron-apt-xapian-index
@@ -14,9 +14,8 @@ profile cron-apt-xapian-index @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/{,e}grep   rix,
-
   @{bin}/nice       rix,
   @{bin}/ionice     rix,
 
diff --git a/apparmor.d/groups/cron/cron-aptitude b/apparmor.d/groups/cron/cron-aptitude
index a471b2844..82b33e8ab 100644
--- a/apparmor.d/groups/cron/cron-aptitude
+++ b/apparmor.d/groups/cron/cron-aptitude
@@ -17,7 +17,7 @@ profile cron-aptitude @{exec_path} {
   @{bin}/cp         rix,
   @{bin}/date       rix,
   @{bin}/basename   rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/dirname    rix,
   @{bin}/rm         rix,
   @{bin}/mv         rix,
diff --git a/apparmor.d/groups/cron/cron-mlocate b/apparmor.d/groups/cron/cron-mlocate
index ec9690938..f91956bcd 100644
--- a/apparmor.d/groups/cron/cron-mlocate
+++ b/apparmor.d/groups/cron/cron-mlocate
@@ -15,7 +15,7 @@ profile cron-mlocate @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/true       rix,
   @{bin}/flock      rix,
   @{bin}/nocache    rix,
diff --git a/apparmor.d/groups/cron/cron-plocate b/apparmor.d/groups/cron/cron-plocate
index 0604eba3a..7f52d1a14 100644
--- a/apparmor.d/groups/cron/cron-plocate
+++ b/apparmor.d/groups/cron/cron-plocate
@@ -15,7 +15,7 @@ profile cron-plocate @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/true       rix,
   @{bin}/flock      rix,
   @{bin}/nocache    rix,
diff --git a/apparmor.d/groups/cron/cron-popularity-contest b/apparmor.d/groups/cron/cron-popularity-contest
index fa6e9874f..44d3a546f 100644
--- a/apparmor.d/groups/cron/cron-popularity-contest
+++ b/apparmor.d/groups/cron/cron-popularity-contest
@@ -74,7 +74,7 @@ profile cron-popularity-contest @{exec_path} {
     @{bin}/mv         rix,
     @{bin}/rm         rix,
     @{bin}/touch      rix,
-    @{bin}/which      rix,
+    @{bin}/which{,.debianutils}  rix,
     @{sh_path}        rix,
 
     /var/log/ r,
diff --git a/apparmor.d/groups/display-manager/x11-xsession b/apparmor.d/groups/display-manager/x11-xsession
index 4eb916aab..361a30b26 100644
--- a/apparmor.d/groups/display-manager/x11-xsession
+++ b/apparmor.d/groups/display-manager/x11-xsession
@@ -34,7 +34,7 @@ profile x11-xsession @{exec_path} {
   @{bin}/tail       rix,
   @{bin}/tempfile   rix,
   @{bin}/touch      rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/dbus-update-activation-environment rCx -> dbus,
 
diff --git a/apparmor.d/groups/gnome/gdm-xsession b/apparmor.d/groups/gnome/gdm-xsession
index 9804ddcb0..03e77816c 100644
--- a/apparmor.d/groups/gnome/gdm-xsession
+++ b/apparmor.d/groups/gnome/gdm-xsession
@@ -35,7 +35,7 @@ profile gdm-xsession @{exec_path} {
   @{bin}/tr              rix,
   @{bin}/truncate        rix,
   @{bin}/tty             rix,
-  @{bin}/which           rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/zsh             rix,
 
   @{bin}/dbus-update-activation-environment    rCx -> dbus,
diff --git a/apparmor.d/groups/kde/sddm-xsession b/apparmor.d/groups/kde/sddm-xsession
index b5cceee95..f27f3dc3c 100644
--- a/apparmor.d/groups/kde/sddm-xsession
+++ b/apparmor.d/groups/kde/sddm-xsession
@@ -40,7 +40,7 @@ profile sddm-xsession @{exec_path} {
   @{bin}/tcsh       rix,
   @{bin}/tempfile   rix,
   @{bin}/touch      rix,
-  @{bin}/which{,.*} rix,
+  @{bin}/which{,.debianutils} rix,
   @{bin}/zsh        rix,
 
   @{bin}/dbus-update-activation-environment  rCx -> dbus,
diff --git a/apparmor.d/groups/network/openvpn b/apparmor.d/groups/network/openvpn
index 6431ee98a..a6ff1a939 100644
--- a/apparmor.d/groups/network/openvpn
+++ b/apparmor.d/groups/network/openvpn
@@ -84,7 +84,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
     @{sh_path}                rix,
     @{bin}/cut                rix,
     @{bin}/ip                 rix,
-    @{bin}/which              rix,
+    @{bin}/which{,.debianutils}  rix,
     @{sbin}/xtables-nft-multi rix,
 
     /etc/iproute2/rt_tables r,
diff --git a/apparmor.d/groups/pacman/pacman b/apparmor.d/groups/pacman/pacman
index e72c62667..e9f3bf807 100644
--- a/apparmor.d/groups/pacman/pacman
+++ b/apparmor.d/groups/pacman/pacman
@@ -101,7 +101,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
   @{sbin}/update-grub                rPx,
   @{bin}/update-mime-database        rPx,
   @{bin}/vercmp                      rix,
-  @{bin}/which                       rix,
+  @{bin}/which{,.debianutils}        rix,
   @{bin}/xmlcatalog                  rix,
   @{lib}/systemd/systemd-*           rPx,
   @{lib}/ghc-@{version}/bin/ghc-pkg-@{version} rPx,
diff --git a/apparmor.d/groups/ubuntu/apport-gtk b/apparmor.d/groups/ubuntu/apport-gtk
index bb5cd329c..5a4e130a0 100644
--- a/apparmor.d/groups/ubuntu/apport-gtk
+++ b/apparmor.d/groups/ubuntu/apport-gtk
@@ -52,7 +52,7 @@ profile apport-gtk @{exec_path} {
   @{bin}/systemctl              rCx -> systemctl,
   @{bin}/systemd-detect-virt    rPx,
   @{bin}/uname                  rix,
-  @{bin}/which                  rix,
+  @{bin}/which{,.debianutils}   rix,
   @{lib}/{,colord/}colord-sane  rPx,
   @{lib}/@{multiarch}/ld*.so*   rix,
   /usr/share/apport/root_info_wrapper rix,
diff --git a/apparmor.d/profiles-a-f/anyremote b/apparmor.d/profiles-a-f/anyremote
index 6af2cd38d..43ecdb0cd 100644
--- a/apparmor.d/profiles-a-f/anyremote
+++ b/apparmor.d/profiles-a-f/anyremote
@@ -41,7 +41,7 @@ profile anyremote @{exec_path} {
   @{bin}/tail       rix,
   @{bin}/tr         rix,
   @{bin}/wc         rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/convert-im6.q16 rCx -> imagemagic,
   @{bin}/killall         rCx -> killall,
diff --git a/apparmor.d/profiles-a-f/aspell-autobuildhash b/apparmor.d/profiles-a-f/aspell-autobuildhash
index 43edd3233..a10df8394 100644
--- a/apparmor.d/profiles-a-f/aspell-autobuildhash
+++ b/apparmor.d/profiles-a-f/aspell-autobuildhash
@@ -20,7 +20,7 @@ profile aspell-autobuildhash @{exec_path} flags=(complain) {
   @{bin}/gzip                 rix,
   @{bin}/precat               rix,
   @{bin}/prezip-bin           rix,
-  @{bin}/which                rix,
+  @{bin}/which{,.debianutils} rix,
   @{bin}/zcat                 rix,
 
   @{bin}/dpkg-trigger         rPx,
diff --git a/apparmor.d/profiles-a-f/claws-mail b/apparmor.d/profiles-a-f/claws-mail
index bb7dfd3b8..263bb5794 100644
--- a/apparmor.d/profiles-a-f/claws-mail
+++ b/apparmor.d/profiles-a-f/claws-mail
@@ -24,7 +24,7 @@ profile claws-mail @{exec_path} flags=(complain) {
   @{exec_path} mr,
 
   @{sh_path}        rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/gpg{,2}    rCx -> gpg,
   @{bin}/gpgsm      rCx -> gpg,
diff --git a/apparmor.d/profiles-g-l/ganyremote b/apparmor.d/profiles-g-l/ganyremote
index b2dc7b92d..727bf8cdf 100644
--- a/apparmor.d/profiles-g-l/ganyremote
+++ b/apparmor.d/profiles-g-l/ganyremote
@@ -30,7 +30,7 @@ profile ganyremote @{exec_path} {
   @{bin}/{,e}grep    rix,
   @{bin}/cut         rix,
   @{bin}/id          rix,
-  @{bin}/which       rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tr          rix,
   @{bin}/{m,g,}awk   rix,
 
diff --git a/apparmor.d/profiles-g-l/gsmartcontrol-root b/apparmor.d/profiles-g-l/gsmartcontrol-root
index 515d2234c..4fdb1084b 100644
--- a/apparmor.d/profiles-g-l/gsmartcontrol-root
+++ b/apparmor.d/profiles-g-l/gsmartcontrol-root
@@ -15,7 +15,7 @@ profile gsmartcontrol-root @{exec_path} {
   @{exec_path} r,
   @{sh_path}        rix,
 
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/pkexec     rCx -> pkexec,
 
diff --git a/apparmor.d/profiles-g-l/kanyremote b/apparmor.d/profiles-g-l/kanyremote
index 10e085799..91eb37c58 100644
--- a/apparmor.d/profiles-g-l/kanyremote
+++ b/apparmor.d/profiles-g-l/kanyremote
@@ -31,7 +31,7 @@ profile kanyremote @{exec_path} {
   @{bin}/{,e}grep   rix,
   @{bin}/cut        rix,
   @{bin}/id         rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tr         rix,
   @{bin}/{m,g,}awk  rix,
   @{bin}/head       rix,
diff --git a/apparmor.d/profiles-g-l/kernel b/apparmor.d/profiles-g-l/kernel
index 133cf8ae7..6bc2c8961 100644
--- a/apparmor.d/profiles-g-l/kernel
+++ b/apparmor.d/profiles-g-l/kernel
@@ -33,7 +33,7 @@ profile kernel @{exec_path} {
   @{bin}/touch      rix,
   @{bin}/tr         rix,
   @{bin}/uname      rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/apt-config               rPx,
   @{bin}/dpkg                     rPx -> child-dpkg,
diff --git a/apparmor.d/profiles-m-r/mumble-overlay b/apparmor.d/profiles-m-r/mumble-overlay
index c077f3836..86792860c 100644
--- a/apparmor.d/profiles-m-r/mumble-overlay
+++ b/apparmor.d/profiles-m-r/mumble-overlay
@@ -16,7 +16,7 @@ profile mumble-overlay @{exec_path} {
   @{sh_path}        rix,
 
   @{bin}/file       rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/glxgears   rPx,
 
diff --git a/apparmor.d/profiles-m-r/openbox b/apparmor.d/profiles-m-r/openbox
index e4e8a36e2..899290792 100644
--- a/apparmor.d/profiles-m-r/openbox
+++ b/apparmor.d/profiles-m-r/openbox
@@ -58,7 +58,7 @@ profile openbox @{exec_path} {
     @{lib}/@{multiarch}/openbox-xdg-autostart rix,
 
     @{sh_path}        rix,
-    @{bin}/which      rix,
+    @{bin}/which{,.debianutils}   rix,
 
     # Apps allowed to run
     @{bin}/*                      rPUx,
diff --git a/apparmor.d/profiles-m-r/os-prober b/apparmor.d/profiles-m-r/os-prober
index 162c0b743..da853aa9a 100644
--- a/apparmor.d/profiles-m-r/os-prober
+++ b/apparmor.d/profiles-m-r/os-prober
@@ -51,7 +51,7 @@ profile os-prober @{exec_path} flags=(attach_disconnected) {
   @{bin}/udevadm           rPx,
   @{bin}/umount            rix,
   @{bin}/uname             rix,
-  @{bin}/which             rix,
+  @{bin}/which{,.debianutils}  rix,
   @{lib}/newns             rix,
   @{lib}/os-prober/*       rix,
   @{lib}/os-probes/{,**}   rix,
diff --git a/apparmor.d/profiles-m-r/pass b/apparmor.d/profiles-m-r/pass
index d13099bc3..096f0316a 100644
--- a/apparmor.d/profiles-m-r/pass
+++ b/apparmor.d/profiles-m-r/pass
@@ -40,7 +40,7 @@ profile pass @{exec_path} {
   @{bin}/tr           ix,
   @{bin}/tree         ix,
   @{bin}/tty          ix,
-  @{bin}/which        ix,
+  @{bin}/which{,.debianutils}  ix,
 
   @{bin}/git             Cx -> git,
   @{bin}/gpg{2,}         Cx -> gpg,
diff --git a/apparmor.d/profiles-m-r/pokemmo b/apparmor.d/profiles-m-r/pokemmo
index 111b157c5..324b08f17 100644
--- a/apparmor.d/profiles-m-r/pokemmo
+++ b/apparmor.d/profiles-m-r/pokemmo
@@ -37,7 +37,7 @@ profile pokemmo @{exec_path} flags=(attach_disconnected) {
 
   @{bin}/java ix,
   @{bin}/perl ix,
-  @{bin}/which ix,
+  @{bin}/which{,.debianutils} ix,
   @{lib}/jvm/java-@{int}-openjdk/bin/java ix,
 
   # Installer
diff --git a/apparmor.d/profiles-m-r/protonmail-bridge-core b/apparmor.d/profiles-m-r/protonmail-bridge-core
index ee7adab75..45c6766e3 100644
--- a/apparmor.d/profiles-m-r/protonmail-bridge-core
+++ b/apparmor.d/profiles-m-r/protonmail-bridge-core
@@ -72,7 +72,7 @@ profile protonmail-bridge-core @{exec_path} flags=(attach_disconnected) {
     @{bin}/tail        rix,
     @{bin}/tree        rix,
     @{bin}/tty         rix,
-    @{bin}/which       rix,
+    @{bin}/which{,.debianutils}  rix,
 
          owner @{user_passwordstore_dirs}/ r,
          owner @{user_passwordstore_dirs}/.gpg-id r,
diff --git a/apparmor.d/profiles-s-z/ucf b/apparmor.d/profiles-s-z/ucf
index 0a7b992b6..3c3374d85 100644
--- a/apparmor.d/profiles-s-z/ucf
+++ b/apparmor.d/profiles-s-z/ucf
@@ -33,7 +33,7 @@ profile ucf @{exec_path} {
   @{bin}/seq            rix,
   @{bin}/stat           rix,
   @{bin}/tr             rix,
-  @{bin}/which          rix,
+  @{bin}/which{,.debianutils}  rix,
 
   @{bin}/dpkg-query     rpx,
   @{bin}/dpkg-divert    rPx,
diff --git a/apparmor.d/profiles-s-z/update-pciids b/apparmor.d/profiles-s-z/update-pciids
index bba603690..901dae9a0 100644
--- a/apparmor.d/profiles-s-z/update-pciids
+++ b/apparmor.d/profiles-s-z/update-pciids
@@ -24,7 +24,7 @@ profile update-pciids @{exec_path} {
   @{bin}/chmod      rix,
   @{bin}/echo       rix,
   @{bin}/cat        rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/bunzip2    rix,
   @{bin}/bzip2      rix,
   @{bin}/gzip       rix,
diff --git a/apparmor.d/profiles-s-z/uupdate b/apparmor.d/profiles-s-z/uupdate
index eb26a4967..88a6cd406 100644
--- a/apparmor.d/profiles-s-z/uupdate
+++ b/apparmor.d/profiles-s-z/uupdate
@@ -18,7 +18,7 @@ profile uupdate @{exec_path} flags=(complain) {
   @{sh_path}        rix,
 
   @{bin}/basename   rix,
-  @{bin}/which      rix,
+  @{bin}/which{,.debianutils}  rix,
   @{bin}/tr         rix,
   @{bin}/{,e}grep   rix,
   @{bin}/getopt     rix,
diff --git a/apparmor.d/profiles-s-z/xinit b/apparmor.d/profiles-s-z/xinit
index 61151a7db..9abc02350 100644
--- a/apparmor.d/profiles-s-z/xinit
+++ b/apparmor.d/profiles-s-z/xinit
@@ -35,7 +35,7 @@ profile xinit @{exec_path} {
   @{bin}/tail         rix,
   @{bin}/tempfile     rix,
   @{bin}/touch        rix,
-  @{bin}/which        rix,
+  @{bin}/which{,.debianutils}  rix,
   /etc/X11/xinit/xinitrc   rix,
   /etc/X11/xinit/xserverrc rix,