diff --git a/roles/container-engine/cri-o/tasks/main.yaml b/roles/container-engine/cri-o/tasks/main.yaml
index bdc308350..2b84b0978 100644
--- a/roles/container-engine/cri-o/tasks/main.yaml
+++ b/roles/container-engine/cri-o/tasks/main.yaml
@@ -95,6 +95,16 @@
     - ansible_distribution == "Debian"
     - ansible_distribution_version == "10"
 
+- name: Remove dpkg hold
+  dpkg_selections:
+    name: "{{ item | split ('=') | first }}"
+    selection: install
+  when:
+    - ansible_pkg_mgr == 'apt'
+  changed_when: false
+  with_items:
+    - "{{ crio_packages }}"
+
 - name: Install cri-o packages
   package:
     name: "{{ item }}"
@@ -106,6 +116,17 @@
   retries: 4
   delay: "{{ retry_stagger | d(3) }}"
 
+# This is required to ensure any apt upgrade will not break kubernetes
+- name: Tell Debian hosts not to change the cri-o version with apt upgrade
+  dpkg_selections:
+    name: "{{ item | split ('=') | first }}"
+    selection: hold
+  when:
+    - ansible_pkg_mgr == 'apt'
+  changed_when: false
+  with_items:
+    - "{{ crio_packages }}"
+
 - name: Check if already installed
   stat:
     path: "/bin/crio"
diff --git a/roles/container-engine/cri-o/tasks/reset.yml b/roles/container-engine/cri-o/tasks/reset.yml
index 24f50be3d..f5e0e54e9 100644
--- a/roles/container-engine/cri-o/tasks/reset.yml
+++ b/roles/container-engine/cri-o/tasks/reset.yml
@@ -81,6 +81,16 @@
   tags:
     - reset_crio
 
+- name: CRI-O | Remove dpkg hold
+  dpkg_selections:
+    name: "{{ item }}"
+    selection: install
+  when: ansible_pkg_mgr == 'apt'
+  changed_when: false
+  with_items: "{{ crio_packages }}"
+  tags:
+    - reset_crio
+
 - name: CRI-O | Uninstall CRI-O package
   package:
     name: "{{ item }}"