diff -Nru pkgsel-0.43ubuntu1/debian/changelog pkgsel-0.43ubuntu1.1/debian/changelog
--- pkgsel-0.43ubuntu1/debian/changelog	2015-12-17 15:42:08.000000000 +0000
+++ pkgsel-0.43ubuntu1.1/debian/changelog	2016-06-15 06:57:34.000000000 +0000
@@ -1,3 +1,10 @@
+pkgsel (0.43ubuntu1.1) xenial; urgency=medium
+
+  * debian/postinst: get our "No automatic updates" policy selection to really
+    seed unattended-upgrades with automatic upgrades disabled. (LP: #1585771)
+
+ -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 14 Jun 2016 17:43:53 +0300
+
 pkgsel (0.43ubuntu1) xenial; urgency=medium
 
   * Resynchronise with Debian.  Remaining changes:
diff -Nru pkgsel-0.43ubuntu1/debian/postinst pkgsel-0.43ubuntu1.1/debian/postinst
--- pkgsel-0.43ubuntu1/debian/postinst	2015-12-17 15:39:23.000000000 +0000
+++ pkgsel-0.43ubuntu1.1/debian/postinst	2016-06-14 14:42:35.000000000 +0000
@@ -185,10 +185,15 @@
 db_input "$update_priority" pkgsel/update-policy || true
 db_go || true
 db_get pkgsel/update-policy
-if [ "$RET" = unattended-upgrades ]; then
-	echo 'unattended-upgrades unattended-upgrades/enable_auto_updates boolean true' | \
+if [ "$RET" = none ]; then
+	# We might pull in unattended-upgrades, which defaults to doing security
+	# updates automatically. Seed it to have auto updates disabled so that if
+	# we *do* pull it in, it won't break stuff.
+	echo 'unattended-upgrades unattended-upgrades/enable_auto_updates boolean false' | \
 		log-output -t pkgsel chroot /target debconf-set-selections || \
 		true
+elif [ "$RET" = unattended-upgrades ]; then
+	# unattended-upgrades defaults to true on installation if otherwise untouched.
 	apt-install unattended-upgrades || true
 elif [ "$RET" = landscape ]; then
 	echo 'landscape-client landscape-client/register_system boolean true' | \