diff --git a/src/claim.cgi.c b/src/claim.cgi.c
index 928fa89..e9a1f2a 100644
--- a/src/claim.cgi.c
+++ b/src/claim.cgi.c
@@ -48,7 +48,7 @@ main(int argc, char *argv[])
 
 
   /* Does the token exist? */
-  if (! fgrepx(token, srv_path("tokens.db"))) {
+  if (! fgrepx(token, srv_path("var/tokens.db"))) {
     cgi_page("Token does not exist", "");
   }
 
@@ -69,7 +69,7 @@ main(int argc, char *argv[])
       my_snprintf(line, sizeof(line),
                   "%s %s", team, token);
       award_and_log_uniquely(team, category, 1,
-                             "tokens.db", line);
+                             "var/tokens.db", line);
     }
   }
 
diff --git a/src/common.c b/src/common.c
index 0bfc2db..5807e64 100644
--- a/src/common.c
+++ b/src/common.c
@@ -364,7 +364,7 @@ team_exists(char const *teamhash)
   }
 
   /* stat seems to be the preferred way to check for existence. */
-  ret = stat(srv_path("teams/names/%s", teamhash), &buf);
+  ret = stat(srv_path("var/teams/names/%s", teamhash), &buf);
   if (-1 == ret) {
     return 0;
   }
@@ -420,7 +420,7 @@ award_points(char const *teamhash,
      token log.
   */
 
-  filename = srv_path("points.new/%d.%d.%s.%s.%ld",
+  filename = srv_path("var/points.new/%d.%d.%s.%s.%ld",
                       now, getpid(),
                       teamhash, category, points);
 
diff --git a/src/in.tokend.c b/src/in.tokend.c
index 543866e..04c8f49 100644
--- a/src/in.tokend.c
+++ b/src/in.tokend.c
@@ -93,7 +93,7 @@ main(int argc, char *argv[])
     int fd;
     int ret;
 
-    fd = open(srv_path("token.keys/%.*s", servicelen, service), O_RDONLY);
+    fd = open(srv_path("var/token.keys/%.*s", servicelen, service), O_RDONLY);
     if (-1 == fd) {
       perror("Open key");
       return 0;
@@ -143,7 +143,7 @@ main(int argc, char *argv[])
     int ret;
 
     do {
-      fd = open(srv_path("tokens.db"), O_WRONLY | O_CREAT, 0666);
+      fd = open(srv_path("var/tokens.db"), O_WRONLY | O_CREAT, 0666);
       if (-1 == fd) break;
 
       ret = lockf(fd, F_LOCK, 0);
diff --git a/src/puzzler.cgi.c b/src/puzzler.cgi.c
index cf986c5..4a67af5 100644
--- a/src/puzzler.cgi.c
+++ b/src/puzzler.cgi.c
@@ -73,7 +73,7 @@ main(int argc, char *argv[])
     my_snprintf(line, sizeof(line),
                "%s %s %ld", team, category, points);
     award_and_log_uniquely(team, category, points,
-                           "puzzler.db", line);
+                           "var/puzzler.db", line);
   }
 
   cgi_page("Points awarded",
diff --git a/src/puzzles.cgi.c b/src/puzzles.cgi.c
index f12bec8..d2fbb90 100644
--- a/src/puzzles.cgi.c
+++ b/src/puzzles.cgi.c
@@ -59,7 +59,7 @@ main(int argc, char *argv[])
   }
 
   {
-    FILE *f = fopen(srv_path("puzzler.db"), "r");
+    FILE *f = fopen(srv_path("var/puzzler.db"), "r");
     char  cat[CAT_MAX];
     char  points_str[11];
     long  points;