diff --git a/sau/gentoo.py b/sau/gentoo.py
index db0b884..7c5cea5 100644
--- a/sau/gentoo.py
+++ b/sau/gentoo.py
@@ -9,6 +9,7 @@ EIX_SYNC_PATH='/usr/bin/eix-sync'
 RC_SERVICE_PATH='/sbin/rc-service'
 EMERGE_PATH='/usr/bin/emerge'
 EQUERY_PATH='/usr/bin/equery'
+GRUB_MKCONFIG='/usr/sbin/grub-mkconfig'
 
 # parsing output from eix -Ttnc
 package_re = re.compile('^\[([^\]])\] ([^ ]*) \((.*)\): .*$')
@@ -92,6 +93,7 @@ def _sync_portage():
 def pkg_upgrade():
     log = logging.getLogger(sau.LOGNAME)
     conf = sau.config
+    do_system_upgrade = conf.getboolean('default', 'do_system_upgrade', fallback=False)
 
     if conf.getboolean('default', 'do_reposync', fallback=True):
         _sync_portage()
@@ -114,6 +116,7 @@ def pkg_upgrade():
         return False
 
     do_rebuild = True
+    do_grub = False
     for line in out.splitlines():
         if re.match(ignore_re, line):
             continue
@@ -136,6 +139,12 @@ def pkg_upgrade():
         else:
             log.warning('{} -- {} -> {} configured level {} > pkg level {}'.format(name, old, new, sens, common))
             do_rebuild = False
+        if name.startswith('sys-kernel/'):
+            if do_system_upgrade:
+                do_grub = True
+            else:
+                log.warning(f"Kernel package {name} has an update, but system upgrade is disabled")
+                do_rebuild = False
 
     if not do_rebuild:
         log.warning('Some packages require manual attention, did not upgrade')
@@ -185,3 +194,25 @@ def pkg_upgrade():
             for line in out.splitlines():
                 if line.startswith(' * '):
                     log.warning(line)
+
+    if do_grub:
+        for root, dirs, files in os.walk('/boot'):
+            for sysfile in ['config', 'initramfs', 'System.map', 'vmlinuz']:
+                match = sorted(
+                        [f for f in files if f.startswith(f'{sysfile}-')],
+                        reverse=True)
+                for f in match[4:]:
+                    log.debug(f"Removing old kernel file {f}")
+                    os.remove(os.path.join(root, f))
+            break
+
+        cmd = [ GRUB_MKCONFIG, '-o', '/boot/grub/grub.cfg' ]
+        ret, out, err = sau.helpers.exec_cmd(cmd)
+        if ret != 0 or err:
+            log.warning(f"grub-mkconfig returned {ret}:")
+            for line in out.splitlines():
+                log.warning('stdout: {}'.format(line))
+            for line in err.splitlines():
+                log.warning('stderr: {}'.format(line))
+        else:
+            log.info("grub reconfigured")