diff --git a/bundles/apt/files/upgrade-and-reboot b/bundles/apt/files/upgrade-and-reboot
index 269bb55..d4c54de 100644
--- a/bundles/apt/files/upgrade-and-reboot
+++ b/bundles/apt/files/upgrade-and-reboot
@@ -48,6 +48,26 @@ fi
 DEBIAN_FRONTEND=noninteractive apt-get -y -q autoclean
 DEBIAN_FRONTEND=noninteractive apt-get -y -q autoremove
 
+% if clean_old_kernels:
+existing=$(dpkg --get-selections | grep -E '^linux-(image|headers)-[0-9]' || true)
+
+if [[ -z "$existing" ]]
+then
+    echo "ERROR: No installed kernels found! Aborting!" >&2
+    exit 1
+fi
+
+current=$(uname -r | sed -r 's/-[a-zA-Z]+$//')
+latest=$(echo "$existing" | sort --version-sort -t- -k 3,4 | tail -n 1 | sed -r 's/[^0-9]+([0-9]\.[^-]+-[0-9]+).*/\1/')
+todelete=$(echo "$existing" | grep -v -E "($current|$latest)" | awk '{ print $1 }' || true)
+
+if [[ -n "$todelete" ]]
+then
+    DEBIAN_FRONTEND=noninteractive apt-get -qy purge $todelete
+fi
+% endif
+
+
 if [[ -f /var/run/reboot-required ]]
 then
 % if 'mail' in data:
diff --git a/bundles/apt/items.py b/bundles/apt/items.py
index 734126e..6fc42e2 100644
--- a/bundles/apt/items.py
+++ b/bundles/apt/items.py
@@ -31,6 +31,7 @@ files = {
         'content_type': 'mako',
         'mode': '0700',
         'context': {
+            'clean_old_kernels': node.metadata.get('apt/clean_old_kernels', True),
             'data': node.metadata.get('apt/unattended-upgrades', {}),
         }
     },