diff --git a/tool/depot/mk/downloader b/tool/depot/mk/downloader
index d121e25969..99816e895d 100755
--- a/tool/depot/mk/downloader
+++ b/tool/depot/mk/downloader
@@ -39,22 +39,22 @@ ARCHIVES := $(MAKECMDGOALS)
 
 include $(GENODE_DIR)/tool/depot/mk/gpg.inc
 
-$(DEPOT_DIR)/% : $(PUBLIC_DIR)/%.tgz $(PUBLIC_DIR)/%.tgz.sig
+$(DEPOT_DIR)/% : $(PUBLIC_DIR)/%.tar.xz $(PUBLIC_DIR)/%.tar.xz.sig
 	$(VERBOSE)pubkey_file=$(DEPOT_DIR)/$(call archive_user,$*)/pubkey; \
 	          gpg --yes -o $$pubkey_file.dearmored --dearmor $$pubkey_file; \
 	          ( gpg --no-tty --no-default-keyring \
 	                --keyring $$pubkey_file.dearmored \
-	                --verify $(PUBLIC_DIR)/$*.tgz.sig 2> /dev/null; retval=$$?; \
+	                --verify $(PUBLIC_DIR)/$*.tar.xz.sig 2> /dev/null; retval=$$?; \
 	            rm -f $$pubkey_file.dearmored; \
 	            exit $$retval \
 	          ) || ( echo -e "Error: could not verify '$*', signature does not match\n" \
 	                          "      public key '$$pubkey_file'"; \
 	                 false )
 	$(VERBOSE)mkdir -p $(dir $@)
-	$(VERBOSE)tar xfz $(PUBLIC_DIR)/$*.tgz -C $(dir $@)
+	$(VERBOSE)tar xfJ $(PUBLIC_DIR)/$*.tar.xz -C $(dir $@)
 
-DOWNLOADED_FILES := $(addprefix $(PUBLIC_DIR)/,$(MAKECMDGOALS:=.tgz)) \
-                    $(addprefix $(PUBLIC_DIR)/,$(MAKECMDGOALS:=.tgz.sig))
+DOWNLOADED_FILES := $(addprefix $(PUBLIC_DIR)/,$(MAKECMDGOALS:=.tar.xz)) \
+                    $(addprefix $(PUBLIC_DIR)/,$(MAKECMDGOALS:=.tar.xz.sig))
 
 .PRECIOUS: $(DOWNLOADED_FILES)
 
diff --git a/tool/depot/publish b/tool/depot/publish
index e73d846e71..d507e2b00a 100755
--- a/tool/depot/publish
+++ b/tool/depot/publish
@@ -65,18 +65,18 @@ MISSING_PUBKEY_FILES := $(sort \
                               $(if $(call pubkey_path,$A),,\
                                  $(DEPOT_DIR)/$(call pubkey_filename,$A))))
 
-TARGETS := $(addsuffix .tgz.sig,$(addprefix $(PUBLIC_DIR)/,$(ARCHIVES)))
+TARGETS := $(addsuffix .tar.xz.sig,$(addprefix $(PUBLIC_DIR)/,$(ARCHIVES)))
 
-$(PUBLIC_DIR)/%.tgz.sig : $(PUBLIC_DIR)/%.tgz
+$(PUBLIC_DIR)/%.tar.xz.sig : $(PUBLIC_DIR)/%.tar.xz
 	$(VERBOSE)rm -f $@;
 	$(VERBOSE)gpg --detach-sign --no-tty --use-agent --local-user $(call pubkey_id,$*) $<
 
-.PRECIOUS: $(TARGETS:.tgz.sig=.tgz)
+.PRECIOUS: $(TARGETS:.tar.xz.sig=.tar.xz)
 
-$(PUBLIC_DIR)/%.tgz: $(DEPOT_DIR)/%
+$(PUBLIC_DIR)/%.tar.xz: $(DEPOT_DIR)/%
 	@$(ECHO) "$(DARK_COL)publish$(DEFAULT_COL) $@"
 	$(VERBOSE)test -e $(dir $@) || mkdir -p $(dir $@)
-	$(VERBOSE)tar czf $@ -C $(dir $<) $(notdir $<)
+	$(VERBOSE)tar cJf $@ -C $(dir $<) $(notdir $<)
 
 ifneq ($(MISSING_PUBKEY_FILES),)
 $(MAKECMDGOALS) $(TARGETS): missing_pubkey_files