diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2a7421..6d36777 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,6 +22,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 #### Fixed
 
 - [SITE] Issues with root_domain variable with `wo site update`
+- [SECURE] Wrong sftp-server path in sshd_config
 
 ### v3.9.9.1 - 2019-09-26
 
diff --git a/wo/cli/templates/sshd.mustache b/wo/cli/templates/sshd.mustache
index f05b6c8..5c5383b 100644
--- a/wo/cli/templates/sshd.mustache
+++ b/wo/cli/templates/sshd.mustache
@@ -37,7 +37,7 @@ AcceptEnv LANG LC_*
 LogLevel VERBOSE
 
 # Log sftp level file access (read/write/etc.) that would not be easily logged otherwise.
-Subsystem sftp  /usr/lib/ssh/sftp-server -f AUTHPRIV -l INFO
+Subsystem sftp /usr/lib/openssh/sftp-server -f AUTHPRIV -l INFO
 
 # Host keys the client accepts - order here is honored by OpenSSH
 HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,ssh-rsa,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256