diff --git a/bundles/sysctl/items.py b/bundles/sysctl/items.py
index c4c448c..99860e1 100644
--- a/bundles/sysctl/items.py
+++ b/bundles/sysctl/items.py
@@ -20,6 +20,14 @@ files = {
     },
 }
 
+if node.os == 'debian':
+    # debian insists on creating that file during almost every
+    # unattended-upgrades run. Make it known to bundlewrap, so
+    # it does not get removed during applies.
+    symlinks['/etc/sysctl.d/99-sysctl.conf'] = {
+        'target': '../sysctl.conf',
+    }
+
 directories = {
     '/etc/sysctl.d': {
         'purge': True,