diff --git a/supervise.go b/supervise.go
index 1034293..2a29db4 100644
--- a/supervise.go
+++ b/supervise.go
@@ -205,6 +205,10 @@ func redirectToStatus(w http.ResponseWriter, r *http.Request, path string) {
 	http.Redirect(w, r, u.String(), http.StatusSeeOther)
 }
 
+// killSupervisedServices is called before rebooting when upgrading, allowing
+// processes to terminate in an orderly fashion.
+var killSupervisedServices = func() {}
+
 func superviseServices(services []*service) {
 	for _, s := range services {
 		go supervise(s)
@@ -219,6 +223,20 @@ func superviseServices(services []*service) {
 		return nil
 	}
 
+	killSupervisedServices = func() {
+		for _, s := range services {
+			if s.Stopped() {
+				continue
+			}
+
+			s.setStopped(true)
+
+			if p := s.Process(); p != nil {
+				p.Signal(syscall.SIGTERM)
+			}
+		}
+	}
+
 	http.HandleFunc("/stop", func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
 			http.Error(w, "expected a POST request", http.StatusBadRequest)
diff --git a/update.go b/update.go
index 057a70d..545a61b 100644
--- a/update.go
+++ b/update.go
@@ -166,14 +166,16 @@ func initUpdate() error {
 			return
 		}
 
-		// TODO: implement a shutdown sequence, i.e. kill + timeout + term; unmount, then force-unmount?
-
-		if err := syscall.Unmount("/perm", unix.MNT_FORCE); err != nil {
-			log.Printf("unmounting /perm failed: %v", err)
-		}
-
 		go func() {
-			time.Sleep(1 * time.Second) // give the HTTP response some time to be sent
+			killSupervisedServices()
+
+			// give the HTTP response some time to be sent; allow processes some time to terminate
+			time.Sleep(1 * time.Second)
+
+			if err := syscall.Unmount("/perm", unix.MNT_FORCE); err != nil {
+				log.Printf("unmounting /perm failed: %v", err)
+			}
+
 			if err := unix.Reboot(unix.LINUX_REBOOT_CMD_RESTART); err != nil {
 				http.Error(w, err.Error(), http.StatusInternalServerError)
 			}