diff --git a/debian/changelog b/debian/changelog
index 02e8319a..9346eba0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,8 @@ livecd-rootfs (2.208.1) UNRELEASED; urgency=medium
     on it being in the corresponding tasks.  linux-signed-generic shouldn't
     be in a task because that expands to ABI-versioned packages, and tasks
     can't be updated post-release.
+  * Filter out kernel packages that mistakenly ended up in live tasks, so
+    that we can install updated versions separately (LP: #1325281).
 
  -- Colin Watson <cjwatson@ubuntu.com>  Tue, 24 Jun 2014 04:28:55 +0100
 
diff --git a/live-build/auto/config b/live-build/auto/config
index f414cb01..92003a5e 100755
--- a/live-build/auto/config
+++ b/live-build/auto/config
@@ -39,8 +39,17 @@ add_task ()
 {
 	local pass="$1"
 	shift
+	local filter=
 	local task
 
+	if [ "$1" = --filter ]; then
+		# Add an extra layer of backslash-quoting to anything that's
+		# already backslash-quoted, since it will need to pass
+		# through eval.
+		filter="$(printf %s "$2" | sed 's/\(\\.\)/\\\\\1/g')"
+		shift 2
+	fi
+
 	# The removal of direct task installation support from live-build
 	# poses some problems.  If the chroot has multiarch configured - for
 	# example, if we're building for amd64 - then dumpavail will show
@@ -60,7 +69,7 @@ add_task ()
 	for task; do
 		# We need a ridiculous number of backslashes to protect
 		# parentheses from eval.
-		echo "!chroot chroot apt-cache dumpavail | grep-dctrl -nsPackage \\\\\\( -XFArchitecture $ARCH -o -XFArchitecture all \\\\\\) -a -wFTask $task" >> "config/package-lists/livecd-rootfs.list.chroot_$pass"
+		echo "!chroot chroot apt-cache dumpavail | grep-dctrl -nsPackage \\\\\\( -XFArchitecture $ARCH -o -XFArchitecture all \\\\\\) -a -wFTask $task${filter:+ -a $filter}" >> "config/package-lists/livecd-rootfs.list.chroot_$pass"
 	done
 }
 
@@ -84,6 +93,7 @@ SOURCE='--source false'
 BOOTLOADER=none
 BOOTAPPEND_LIVE=
 LIVE_TASK=
+LIVE_TASK_FILTER=
 PREINSTALLED=false
 PREINSTALL_POOL=
 PREINSTALL_POOL_SEEDS=
@@ -190,6 +200,7 @@ case $PROJECT in
 				;;
 		esac
 		LIVE_TASK='ubuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -212,6 +223,7 @@ case $PROJECT in
 				;;
 		esac
 		LIVE_TASK='kubuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -229,6 +241,7 @@ case $PROJECT in
 	edubuntu|edubuntu-dvd)
 		add_task install minimal standard ubuntu-desktop edubuntu-desktop-gnome
 		LIVE_TASK='edubuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -239,6 +252,7 @@ case $PROJECT in
 		add_task install minimal standard xubuntu-desktop
 		add_package install xterm
 		LIVE_TASK='xubuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -256,6 +270,7 @@ case $PROJECT in
 	mythbuntu)
 		add_task install minimal standard mythbuntu-desktop
 		LIVE_TASK='mythbuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -265,6 +280,7 @@ case $PROJECT in
 	lubuntu)
 		add_task install minimal standard lubuntu-desktop
 		LIVE_TASK='lubuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -281,6 +297,7 @@ case $PROJECT in
 	ubuntu-gnome)
 		add_task install minimal standard ubuntu-gnome-desktop
 		LIVE_TASK='ubuntu-gnome-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -299,6 +316,7 @@ case $PROJECT in
 		add_task install minimal standard ubuntu-desktop
 		add_package install ubuntukylin-default-settings
 		LIVE_TASK='ubuntu-live'
+		LIVE_TASK_FILTER='--not -Pe ^linux-\(headers\|image\|signed\)'
 		case $ARCH in
 			amd64)	add_package live linux-signed-generic ;;
 		esac
@@ -340,17 +358,17 @@ case $PROJECT in
 esac
 
 if [ "$PREINSTALLED" != "true" ] && [ "$LIVE_TASK" ]; then
-	add_task live "$LIVE_TASK"
+	add_task live ${LIVE_TASK_FILTER:+--filter "$LIVE_TASK_FILTER"} "$LIVE_TASK"
 fi
 
 case $PROJECT in
 	ubuntu-dvd)
 		add_task install ubuntu-usb
-		add_task live ubuntu-usb-live
+		add_task live ${LIVE_TASK_FILTER:+--filter "$LIVE_TASK_FILTER"} ubuntu-usb-live
 		;;
 
 	*-dvd)
-		add_task live "$PROJECT-live"
+		add_task live ${LIVE_TASK_FILTER:+--filter "$LIVE_TASK_FILTER"} "$PROJECT-live"
 		;;
 esac