diff --git a/debian/apt.auto-removal.sh b/debian/apt.auto-removal.sh
new file mode 100644
index 000000000..8f6fc2efc
--- /dev/null
+++ b/debian/apt.auto-removal.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+set -e
+
+# Author: Steve Langasek <steve.langasek@canonical.com>
+#
+# Mark as not-for-autoremoval those kernel packages that are:
+#  - the currently booted version
+#  - the kernel version we've been called for
+#  - the latest kernel version (determined using rules copied from the grub
+#    package for deciding which kernel to boot)
+# In the common case, this results in exactly two kernels saved, but it can
+# result in three kernels being saved.  It's better to err on the side of
+# saving too many kernels than saving too few.
+#
+# We generate this list and save it to /etc/apt/apt.conf.d instead of marking
+# packages in the database because this runs from a postinst script, and apt
+# will overwrite the db when it exits.
+
+config_file=/etc/apt/apt.conf.d/01autoremove-kernels
+
+installed_version="$1"
+running_version="$(uname -r)"
+
+
+version_test_gt ()
+{
+	local version_test_gt_sedexp="s/[._-]\(pre\|rc\|test\|git\|old\|trunk\)/~\1/g"
+	local version_a="`echo "$1" | sed -e "$version_test_gt_sedexp"`"
+	local version_b="`echo "$2" | sed -e "$version_test_gt_sedexp"`"
+	dpkg --compare-versions "$version_a" gt "$version_b"
+	return "$?"
+}
+
+list=$(dpkg -l 'linux-image-[0-9]*'|awk '/^ii/ { print $2 }' | sed -e's/linux-image-//')
+
+latest_version=""
+for i in $list; do
+	if version_test_gt "$i" "$latest_version"; then
+		latest_version="$i"
+	fi
+done
+
+kernels=$(sort -u <<EOF
+$latest_version
+$installed_version
+$running_version
+EOF
+)
+
+cat > "$config_file".dpkg-new <<EOF
+# File autogenerated by $0, do not edit
+APT
+{
+  NeverAutoRemove
+  {
+EOF
+for kernel in $kernels; do
+	echo "    \"^linux-image-$kernel.*\";" >> "$config_file".dpkg-new
+	echo "    \"^linux-image-extra-$kernel.*\";" >> "$config_file".dpkg-new
+	echo "    \"^linux-signed-image-$kernel.*\";" >> "$config_file".dpkg-new
+done
+cat >> "$config_file".dpkg-new <<EOF
+  };
+};
+EOF
+mv "$config_file".dpkg-new "$config_file"
diff --git a/debian/apt.conf.autoremove b/debian/apt.conf.autoremove
index c7ad51e66..9684c9c7d 100644
--- a/debian/apt.conf.autoremove
+++ b/debian/apt.conf.autoremove
@@ -4,10 +4,7 @@ APT
   {
 	"^firmware-linux.*";
 	"^linux-firmware$";
-	"^linux-image.*";
 	"^kfreebsd-image.*";
-	"^linux-restricted-modules.*";
-	"^linux-ubuntu-modules-.*";
 	"^gnumach$";
 	"^gnumach-image.*";
   };
diff --git a/debian/apt.dirs b/debian/apt.dirs
index f9c0b6c3e..6d492a30f 100644
--- a/debian/apt.dirs
+++ b/debian/apt.dirs
@@ -7,6 +7,7 @@ etc/apt/apt.conf.d
 etc/apt/preferences.d
 etc/apt/sources.list.d
 etc/apt/trusted.gpg.d
+etc/kernel/postinst.d
 etc/logrotate.d
 var/cache/apt/archives/partial
 var/lib/apt/lists/partial
diff --git a/debian/changelog b/debian/changelog
index cb47dd456..d196bb136 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -6,6 +6,16 @@ apt (0.9.9.1) UNRELEASED; urgency=low
   * apt-pkg/packagemanager.cc:
     - increate APT::pkgPackageManager::MaxLoopCount to 5000
 
+  [ Steve Langasek ]
+  * debian/apt.conf.autoremove: don't include linux-image*,
+    linux-restricted-modules*, and linux-ubuntu-modules* packages in the
+    list to never be autoremoved.
+  * debian/apt.auto-removal.sh, debian/rules, debian/apt.dirs: install new
+    script to /etc/kernel/postinst.d/ which ensures we only automatically
+    keep the currently-running kernel, the being-installed kernel, and the
+    newest kernel, so we don't fill /boot up with an unlimited number of
+    kernels.  LP: #923876.
+
  -- Michael Vogt <michael.vogt@ubuntu.com>  Fri, 05 Jul 2013 16:39:34 +0200
 
 apt (0.9.9) unstable; urgency=low
diff --git a/debian/rules b/debian/rules
index 02fed44d5..3979bd810 100755
--- a/debian/rules
+++ b/debian/rules
@@ -183,6 +183,8 @@ apt: build build-manpages
 # apt install
 #
 	cp debian/apt.conf.autoremove debian/$@/etc/apt/apt.conf.d/01autoremove
+	cp debian/apt.auto-removal.sh debian/$@/etc/kernel/postinst.d/apt-auto-removal
+	chmod 755 debian/$@/etc/kernel/postinst.d/apt-auto-removal
 
 	# make rosetta happy and remove pot files in po/ (but leave stuff
 	# in po/domains/* untouched) and cp *.po into each domain dir