diff --git a/debian/authforge-pam.prerm b/debian/authforge-pam.prerm
new file mode 100755
index 0000000..06a901e
--- /dev/null
+++ b/debian/authforge-pam.prerm
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Deregisters the authforge profile from /etc/pam.d/common-* before
+# the .so disappears. Ordering matters: prerm runs before any files are
+# removed, so /usr/share/pam-configs/authforge is still present here for
+# pam-auth-update to inspect.
+set -e
+
+case "$1" in
+    remove|deconfigure)
+        if [ -x /usr/sbin/pam-auth-update ]; then
+            pam-auth-update --package --remove authforge
+        fi
+        ;;
+    upgrade|failed-upgrade)
+        ;;
+    *)
+        echo "prerm called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0