diff --git a/config.cfg b/config.cfg
index 2f41db7..0addab2 100644
--- a/config.cfg
+++ b/config.cfg
@@ -16,9 +16,14 @@ version_sensitivity=1
 # not close all deleted files (any platform)
 do_reboot=no
 
-# FreeBSD system update (freebsd-update fetch install, not freebsd-update upgrade)
+# Attempt to do a system upgrade
+# FreeBSD: upgrade to latest patch version using freebsd-update fetch install
+# Gentoo: allow upgrade of sys-kernel/-packages, clean old kernels, and update grub-config
 do_system_upgrade=yes
 
+# On Gentoo kernel upgrades, remove all but the last keep_kernels kernels from /boot
+keep_kernels=4
+
 # upgrade packages
 do_package_upgrade=yes
 
@@ -46,9 +51,7 @@ syslog_loglevel=info
 # Gentoo uses the category/package naming scheme
 dev-db/postgresql=1
 
-# Gentoo kernel stuff should be updated manually
-sys-kernel/gentoo-sources=99
-sys-kernel/spl=99
+# It's safer to upgrade zfs manually
 sys-fs/zfs-kmod=99
 
 # FreeBSD uses the short package name (without category)
diff --git a/sau/gentoo.py b/sau/gentoo.py
index 55fdae6..ffc99cb 100644
--- a/sau/gentoo.py
+++ b/sau/gentoo.py
@@ -196,12 +196,16 @@ def pkg_upgrade():
                     log.warning(line)
 
     if do_grub:
+        keep_kernels = conf.getint('default', 'keep_kernels', default=4)
+        if keep_kernels < 1:
+            log.error('keep_kernels cannot be less than one; falling back to default')
+            keep_kernels = 4
         for root, dirs, files in os.walk('/boot'):
             for sysfile in ['config', 'initramfs', 'System.map', 'vmlinuz']:
                 match = sorted(
                         [f for f in files if f.startswith(f'{sysfile}-')],
                         reverse=True)
-                for f in match[4:]:
+                for f in match[keep_kernels:]:
                     log.debug(f"Removing old kernel file {f}")
                     os.remove(os.path.join(root, f))
             break