=== modified file 'debian/changelog'
--- debian/changelog	2015-02-17 23:25:26 +0000
+++ debian/changelog	2015-02-18 17:28:57 +0000
@@ -1,3 +1,10 @@
+ubiquity (2.18.8.6) trusty; urgency=medium
+
+  * Be sure to include the top level linux-signed-* metapackage in our
+    list of candidates to keep so we don't accidentally remove it.
+
+ -- Adam Conrad <adconrad@ubuntu.com>  Wed, 18 Feb 2015 10:26:33 -0700
+
 ubiquity (2.18.8.5) trusty; urgency=medium
 
   * Limit the signed kernel candidates to ones that are already on the

=== modified file 'scripts/check-kernels'
--- scripts/check-kernels	2015-02-17 23:25:26 +0000
+++ scripts/check-kernels	2015-02-18 17:07:32 +0000
@@ -55,11 +55,15 @@
 
 # If base-installer asks for a signed kernel, try hard to lay our hands on
 # one.
+candidates="$(dpkg-query -f '${status} ${package}\n' \
+		-W linux-signed-\* 2>/dev/null | \
+		grep '^install ok installed ' | cut -d' ' -f4 | xargs)"
+
 for kernel in $preferred_kernels; do
 	case $kernel in
 	    linux-signed-*)
 		if [ "$(apt-cache search -n "^$kernel\$")" ]; then
-		    for candidate in $kernels; do
+		    for candidate in $candidates; do
 			case $candidate in
 			    $kernel)
 				install_new="${install_new:+$install_new }$kernel"