diff --git a/debian/changelog b/debian/changelog
index be66d2ae..083c30b7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,8 @@ ostree (2016.5-4) UNRELEASED; urgency=medium
     d/p/tests-Use-strict-mode-by-default-for-C-tests.patch: add patches
     to make sure the tests fail as soon as something goes wrong
   * Build-depend on procps, used to check for leaked processes
+  * debian/test.sh: factor out our dh_auto_test wrapper, and clean
+    up any stray processes even if the test fails
 
  -- Simon McVittie <smcv@debian.org>  Sat, 11 Jun 2016 19:52:40 +0100
 
diff --git a/debian/rules b/debian/rules
index 2c6fae10..5edd70b3 100755
--- a/debian/rules
+++ b/debian/rules
@@ -26,14 +26,7 @@ override_dh_auto_configure:
 	chmod +x tests/*.js
 
 override_dh_auto_test:
-	VERBOSE=1 dh_auto_test
-	# One test creates multiple GPG homedirs, each with its own agent
-	pkill --full "gpg-agent --homedir /var/tmp/tap-test\\.[^/]+/.*" || :
-	if pgrep lt-ostree || pgrep --full "gpg-agent --homedir /var/tmp/tap-test."; then \
-		echo "WARNING: daemon processes were leaked"; \
-		pgrep gpg-agent | xargs --no-run-if-empty ps ww; \
-		pgrep lt-ostree | xargs --no-run-if-empty ps ww; \
-	fi
+	debian/test.sh
 
 override_dh_auto_install:
 	dh_auto_install
diff --git a/debian/test.sh b/debian/test.sh
new file mode 100755
index 00000000..69e4f8df
--- /dev/null
+++ b/debian/test.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+set -e
+
+export VERBOSE=1
+
+exit_status=0
+dh_auto_test || exit_status=1
+
+pkill --full "gpg-agent --homedir /var/tmp/tap-test\\.[^/]+/.*" || :
+
+if pgrep lt-ostree || pgrep --full "gpg-agent --homedir /var/tmp/tap-test."; then \
+    echo "WARNING: daemon processes were leaked"
+    pgrep gpg-agent | xargs --no-run-if-empty ps ww
+    pgrep lt-ostree | xargs --no-run-if-empty ps ww
+fi
+
+exit $exit_status
+
+# vim:set et sw=4 sts=4: