Block Package and Kernel Updates on Debian

Here is how to block package and kernel updates on Debian. Sometimes a newer version of a package or kernel breaks something that was working fine before, a driver that stops working, a service that crashes on startup, or a dependency conflict that only shows up after the fact. Manually skipping that one package every time you run an upgrade is tedious and easy to forget. Holding it instead means Debian simply leaves it alone until you decide otherwise.

What you need

• A Hostner dedicated server running Debian
• Root or sudo access via SSH
• The exact name of the package (or kernel version) you want to hold, since apt-mark needs it precisely, not just a partial match

Step 1: Block package updates on Debian

To stop a specific package from being installed or upgraded at all, use apt-mark:

~ $ sudo apt-mark hold package-name

Replace package-name with the actual package, for example nginx. Confirm it worked:

~ $ apt-mark showhold

The package now appears in that list, and apt upgrade will skip it entirely from here on, without you needing to remember to exclude it manually every time.

To reverse this later:

~ $ sudo apt-mark unhold package-name

Step 2: Block a specific version instead of the whole package

If you want to allow future updates but block one particular version, use apt pinning instead. This gives you more control than a full hold, since the package can still move forward past the specific version you are avoiding. Open (or create) the preferences file:

~ $ sudo nano /etc/apt/preferences

Add a block like this:

~ $ Package: package-name ~ $ Pin: version 1.2.3-1 ~ $ Pin-Priority: -1

Replace package-name and 1.2.3-1 with the actual package and version you want blocked. A priority below 0 tells apt to never install that specific version, while later versions remain installable.

Step 3: Block kernel updates on Debian

Kernel updates work the same way, since the kernel is just another package under the hood. This matters more than it might seem, a kernel update that breaks a specific driver or virtualization feature can take a server offline in a way a regular package update rarely does. First, check which kernel packages are currently installed:

~ $ dpkg -l “$(uname -r)” | grep kernel

Hold each one individually with apt-mark, the same command from Step 1, repeated for every kernel-related package name in that output. This typically includes the kernel image and its matching headers.

If it does not work

If a held package still gets replaced, check whether something installed it as a dependency of another package, apt-mark hold blocks direct upgrades but does not always stop a dependency chain from pulling in a newer version indirectly. Held packages are also easy to forget about over time, which becomes a real security risk once a genuinely important security patch is the one being blocked. Set a reminder to review your held packages every so often, a quick apt-mark showhold once a month costs nothing and keeps old holds from quietly becoming a liability. For the full technical background on apt pinning and priorities, the official APT preferences documentation covers every option in detail.

No ticket needed. One command, and that one troublesome package stops updating itself into a problem again, until you decide it is time to let it move forward.

See more guides in Docs.