diff --git a/debian/bin/fix-shebang b/debian/bin/fix-shebang
new file mode 100755
index 000000000..44e775a76
--- /dev/null
+++ b/debian/bin/fix-shebang
@@ -0,0 +1,12 @@
+#!/usr/bin/perl -pi
+
+# Change "#!/usr/bin/env perl" to "#!/usr/bin/perl" (policy §10.4).
+# Other uses of /usr/bin/env should probably be converted as well, but
+# policy doesn't specify what to do.
+if ($. == 1 && m|^\#!\s*/usr/bin/env\s+(.+)|) {
+    if ($1 == "perl") {
+	$_ = "#!/usr/bin/perl\n";
+    } else {
+	print STDERR "W: Found #!/usr/bin/env $1 and don't know what to substitute\n";
+    }
+}
diff --git a/debian/changelog b/debian/changelog
index 9678f22dc..4903ebf18 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -13,6 +13,8 @@ linux (4.18~rc7-1~exp1) UNRELEASED; urgency=medium
   * certs: Remove certificates for test key used in Debian signing service and
     for my personal signing key
   * certs: Add certificate for production key used in Debian signing service
+  * Update policy version to 4.2.0:
+    - linux-kbuild: Change "#!/usr/bin/env perl" to "#!/usr/bin/perl"
 
  -- Uwe Kleine-König <ukleinek@debian.org>  Sat, 21 Jul 2018 16:52:01 +0200
 
diff --git a/debian/rules.d/Makefile.inc b/debian/rules.d/Makefile.inc
index 48f8c2e7c..719e8ca67 100644
--- a/debian/rules.d/Makefile.inc
+++ b/debian/rules.d/Makefile.inc
@@ -44,7 +44,9 @@ SCRIPTS_REAL = $(wildcard $(addprefix $(top_srcdir)/$(OUTDIR)/,$(SCRIPTS)))
 install-local-scripts: $(SCRIPTS_REAL)
 	@for p in $^; do \
 	  echo " install -m755 '$$p' '$(DESTDIR)/$(installdir)'"; \
-	  install -D -m755 "$$p" "$(DESTDIR)/$(installdir)/$$(basename $$p)"; \
+	  install -D -m755 \
+	    -s --strip-program $(top_srcdir)/debian/bin/fix-shebang \
+	    "$$p" "$(DESTDIR)/$(installdir)/$$(basename $$p)"; \
 	done
 
 DATA_REAL = $(wildcard $(addprefix $(top_srcdir)/$(OUTDIR)/,$(DATA)))