diff --git a/morph/lib/issuer-aws.nix b/morph/lib/issuer-aws.nix
index 9767e1ad27f8de58898786a0b70955a07e16e4fb..4c3f866ef9c68936493dc0ca630abf1f2e4e6130 100644
--- a/morph/lib/issuer-aws.nix
+++ b/morph/lib/issuer-aws.nix
@@ -19,6 +19,10 @@
   # See https://unix.stackexchange.com/a/554500/81275
   boot.kernelModules = [ "loop" ];
 
+  # NixOS likes to fill up boot partitions with (by default) 100 old kernels.
+  # Keep a (for us) more reasonable number around.
+  boot.loader.grub.configurationLimit = 8;
+
   # Break the tie between AWS and morph for the hostname by forcing the
   # morph-supplied name.  See also
   # <https://github.com/DBCDK/morph/issues/146>.
diff --git a/nixos/modules/100tb.nix b/nixos/modules/100tb.nix
index 997e82e18404a663bb7900e67b60859a27f653ef..bd8a11c8e45b3dd5fe01e65c366aa0c04683b00e 100644
--- a/nixos/modules/100tb.nix
+++ b/nixos/modules/100tb.nix
@@ -105,6 +105,9 @@ in {
   { boot.loader.grub.enable = true;
     boot.loader.grub.device = if cfg.grubDeviceID == "nodev"  then "nodev" else "/dev/disk/by-id/${cfg.grubDeviceID}";
     boot.loader.timeout = 10;
+    # NixOS likes to fill up boot partitions with (by default) 100 old kernels.
+    # Keep a (for us) more reasonable number around.
+    boot.loader.grub.configurationLimit = 8;
     networking.firewall.enable = false;
 
     networking.hostId = cfg.hostId;