diff --git a/debian/changelog b/debian/changelog
index 575fb00..f5b0e05 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+ca-certificates (20090814) unstable; urgency=low
+
+  * Call Debconf and its db_purge as early as possible in postrm.
+    (Closes: #541275)
+
+ -- Philipp Kern <pkern@debian.org>  Fri, 14 Aug 2009 11:10:00 +0200
+
 ca-certificates (20090709) unstable; urgency=low
 
   * Fix purge by checking for `/etc/ssl/certs' first.  (Closes: #536331)
diff --git a/debian/config b/debian/config
index 288c63a..149ea95 100644
--- a/debian/config
+++ b/debian/config
@@ -5,7 +5,7 @@ set -e
 
 action="$1"
 cur_version="$2"
-this_version='20090709'
+this_version='20090814'
 pt_BR_fixed_version="20080616"
 
 if test -f /etc/ca-certificates.conf; then
diff --git a/debian/postrm b/debian/postrm
index a397de9..9b3c29c 100644
--- a/debian/postrm
+++ b/debian/postrm
@@ -16,6 +16,14 @@ set -e
 #        * <disappearer's-postrm> `disappear' <r>overwrit>r> <new-version>
 # for details, see /usr/share/doc/packaging-manual/
 
+# Clear the debconf database as early as possible and signal debconf that
+# we are done with it.
+if [ "$1" = purge ] && [ -e /usr/share/debconf/confmodule ]; then
+    . /usr/share/debconf/confmodule
+    db_purge
+    db_stop
+fi
+
 remove_dangling_symlinks() {
     if ! [ -d /etc/ssl/certs ]
     then
@@ -45,10 +53,6 @@ case "$1" in
         [ -d /etc/ssl ] && rmdir --ignore-fail-on-non-empty /etc/ssl
 
         rm -f /etc/ca-certificates.conf*
-        if test -e /usr/share/debconf/confmodule; then
-            . /usr/share/debconf/confmodule
-            db_purge
-        fi
         ;;
 
     upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
diff --git a/debian/rules b/debian/rules
index 5cbc4c0..c84cdc2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -59,7 +59,7 @@ install: build
 binary-indep: build install
 	dh_testdir
 	dh_testroot
-	dh_installdebconf	
+	dh_installdebconf -n
 	dh_installdocs
 	dh_installexamples
 	dh_installman sbin/update-ca-certificates.8