diff --git a/HISTORY.md b/HISTORY.md
index 5186a55d..ba9bbd6d 100644
--- a/HISTORY.md
+++ b/HISTORY.md
@@ -1,7 +1,6 @@
 unreleased
 ==========
 
-  
 ## ⚠️ BREAKING CHANGES
 
   * Change `saveUninitialized` option default from `true` to `false`
@@ -11,6 +10,9 @@ unreleased
   * Expire the session cookie on the response when the session is destroyed
     - Applies to `req.session.destroy()` and to `unset: 'destroy'`, when the request
       came in with a session cookie
+  * Change `unset` option default from `'keep'` to `'destroy'`
+    - Sessions unset via `req.session = null` (or `delete`) are now deleted from the store
+      when the response ends; pass `unset: 'keep'` to restore the previous behavior
 
 ## Other changes
 
diff --git a/README.md b/README.md
index aecc1078..76f042e0 100644
--- a/README.md
+++ b/README.md
@@ -335,7 +335,7 @@ The session store instance, defaults to a new `MemoryStore` instance.
 Control the result of unsetting `req.session` (through `delete`, setting to `null`,
 etc.).
 
-The default value is `'keep'`.
+The default value is `'destroy'`.
 
   - `'destroy'` The session will be destroyed (deleted) when the response ends,
     and the response will set an expired cookie to remove it from the client.
diff --git a/index.js b/index.js
index 894555d4..d7ffdb12 100644
--- a/index.js
+++ b/index.js
@@ -117,8 +117,7 @@ function session(options) {
     throw new TypeError('unset option must be "destroy" or "keep"');
   }
 
-  // TODO: switch to "destroy" on next major
-  var unsetDestroy = opts.unset === 'destroy'
+  var unsetDestroy = opts.unset !== 'keep'
 
   if (Array.isArray(secrets) && secrets.length === 0) {
     throw new TypeError('secret option array must contain one or more strings');
diff --git a/test/session.js b/test/session.js
index d0b0885e..714b0da3 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1301,7 +1301,7 @@ describe('session()', function(){
       assert.throws(session.bind(null, { unset: 'bogus!' }), /unset.*must/)
     });
 
-    it('should default to keep', function(done){
+    it('should default to destroy', function(done){
       var store = new session.MemoryStore();
       var server = createServer({ store: store }, function (req, res) {
         req.session.count = req.session.count || 0
@@ -1324,7 +1324,7 @@ describe('session()', function(){
             if (err) return done(err);
             store.length(function(err, len){
               if (err) return done(err);
-              assert.strictEqual(len, 1)
+              assert.strictEqual(len, 0)
               done();
             });
           });