Prevent Debian Package Upgrades with apt-mark hold

The apt-mark hold command allows Debian administrators to lock designated packages at their current version, preventing the Advanced Package Tool (APT) from automatically updating them during standard system maintenance. This guide covers how this mechanism operates behind the scenes, the exact commands required to lock and unlock packages, and how to verify which packages are currently pinned.

How the Hold Mechanism Works

When you run system updates on Debian using commands such as apt upgrade or apt full-upgrade, APT queries the repositories, calculates dependencies, and prepares to replace older packages with their newer counterparts.

Marking a package with hold alters its status in Debian’s package management database (/var/lib/dpkg/status and APT's extended states file). When APT evaluates candidate versions during an upgrade transaction, its dependency resolver checks these status flags. If a package is marked as held, APT treats the installed version as immutable. The resolver ignores newer versions found in remote repositories and will not schedule the held package for installation, replacement, or removal, effectively freezing it in place.

Holding a Package

To place a package on hold, execute the apt-mark hold command followed by the package name using administrative privileges:

sudo apt-mark hold <package-name>

For example, to prevent the Nginx web server from being updated during bulk upgrades:

sudo apt-mark hold nginx

Once executed, APT will confirm that the package has been set on hold. From this point forward, general update commands will display the package as kept back rather than upgrading it.

Viewing Currently Held Packages

To verify which packages are currently protected from automated upgrades on your system, use the showhold option:

apt-mark showhold

This returns a simple list of all package names on the system that have active hold flags.

Releasing a Package Hold

When you are ready to update the package—such as after testing a new release or applying a necessary patch—you can remove the hold restriction by running:

sudo apt-mark unhold <package-name>

Once unheld, the package will once again be considered by APT for regular updates during the next apt upgrade execution.

Direct Installation Behavior

It is important to note that while apt-mark hold prevents automated updates through bulk upgrade commands, it does not completely prevent manual intervention. If an administrator explicitly targets a held package using sudo apt install <package-name>, APT will warn the user or prompt for confirmation before proceeding to upgrade the package and remove the hold flag.