diff --git a/install/OneClickInstall/install-Debian/install-preq.sh b/install/OneClickInstall/install-Debian/install-preq.sh
index 89fd8f3548..42d2c7ca9a 100644
--- a/install/OneClickInstall/install-Debian/install-preq.sh
+++ b/install/OneClickInstall/install-Debian/install-preq.sh
@@ -10,6 +10,8 @@ cat<<EOF
 
 EOF
 
+hold_package_version
+
 if [ "$DIST" = "debian" ] && [ $(apt-cache search ttf-mscorefonts-installer | wc -l) -eq 0 ]; then
 		echo "deb http://ftp.uk.debian.org/debian/ $DISTRIB_CODENAME main contrib" >> /etc/apt/sources.list
 		echo "deb-src http://ftp.uk.debian.org/debian/ $DISTRIB_CODENAME main contrib" >> /etc/apt/sources.list
@@ -144,5 +146,3 @@ if which apparmor_parser && [ ! -f /etc/apparmor.d/disable/usr.sbin.mysqld ] &&
 	ln -sf /etc/apparmor.d/usr.sbin.mysqld /etc/apparmor.d/disable/;
 	apparmor_parser -R /etc/apparmor.d/usr.sbin.mysqld;
 fi
-
-hold_package_version "dotnet-*" "aspnetcore-*" opensearch redis-server rabbitmq-server opensearch-dashboards fluent-bit
diff --git a/install/OneClickInstall/install-Debian/tools.sh b/install/OneClickInstall/install-Debian/tools.sh
index f96431e9a5..e1265b2522 100644
--- a/install/OneClickInstall/install-Debian/tools.sh
+++ b/install/OneClickInstall/install-Debian/tools.sh
@@ -26,13 +26,23 @@ command_exists () {
 
 # Function to prevent package auto-update
 hold_package_version() {
-    for package in "$@"; do
-        if command -v apt-mark >/dev/null 2>&1 && 
-            dpkg-query -l "$package" >/dev/null 2>&1
-        then
-            apt-mark hold "$package"
-        fi
-    done
+	packages=("dotnet-*" "aspnetcore-*" opensearch redis-server rabbitmq-server opensearch-dashboards fluent-bit)
+	for package in "${packages[@]}"; do 
+		command -v apt-mark >/dev/null 2>&1 && apt-mark showhold | grep -q "^$package" && apt-mark unhold "$package"
+	done
+
+	UNATTENDED_UPGRADES_FILE="/etc/apt/apt.conf.d/50unattended-upgrades"
+	if [ -f ${UNATTENDED_UPGRADES_FILE} ] && grep -q "Package-Blacklist" ${UNATTENDED_UPGRADES_FILE}; then
+		for package in "${packages[@]}"; do 
+			if ! grep -q "$package" ${UNATTENDED_UPGRADES_FILE}; then
+				sed -i "/Package-Blacklist/a \\\t\"$package\";" ${UNATTENDED_UPGRADES_FILE}
+			fi
+		done
+		
+		if systemctl list-units --type=service --state=running | grep -q "unattended-upgrades"; then
+			systemctl restart unattended-upgrades
+		fi
+	fi
 }
 
 check_hardware () {