How to fix E: Held packages were changed and -y was used without --allow-change-held-packages in APT

APTBEGINNERMEDIUMUpdated Dec 29, 2025· 233 views

This error occurs when apt attempts to upgrade a package marked as held while using -y (automatic yes), but the --allow-change-held-packages flag was not provided. Held packages are protected from automatic changes to prevent dependency conflicts.

Quick fix

Fixes E

apt-mark showhold
  1. Check which packages are held
  2. Allow held package changes for this upgrade
  3. Unhold specific packages (if appropriate)
  4. Unhold all packages
apt — error
apt-mark showhold
E: Held packages were changed and -y was used without --allow-change-held-packages

What this error means

When you use apt-mark hold on a package, you're telling APT to protect that package from being automatically upgraded, downgraded, or removed during standard apt upgrade or apt dist-upgrade operations. This is useful when a package has version-specific requirements or compatibility constraints. However, when APT detects that a held package needs to be changed to satisfy dependencies during an upgrade (especially when run with -y for automatic approval), it refuses the operation with this error. This is a safety mechanism to ensure held packages aren't modified without explicit user consent. The error specifically requires the --allow-change-held-packages flag to bypass this protection, forcing APT to acknowledge that you understand the held package may be modified.

Typical symptoms

  • apt upgrade or apt dist-upgrade fails with the held packages error message
  • Automated scripts using -y flag cannot proceed with upgrades
  • Some packages stay held back while others attempt to upgrade
  • CI/CD pipelines fail during dependency installation steps

Common causes

  1. A package is marked as held using apt-mark hold but an upgrade requires changing it
  2. Running apt upgrade with -y flag without allowing held package changes
  3. Dependency resolution requires modifying a protected package
  4. Unattended-upgrades running without proper configuration for held packages

How to fix "E: Held packages were changed and -y was used without --allow-change-held-packages"

1Check which packages are held

First, see what packages have been marked as held on your system:

bash
apt-mark showhold

This lists all packages currently protected from changes. Review this list to understand what's being held.

2Allow held package changes for this upgrade

If you want to proceed with the upgrade while modifying held packages, add the --allow-change-held-packages flag:

bash
sudo apt upgrade --allow-change-held-packages -y

or with apt-get:

bash
sudo apt-get upgrade --allow-change-held-packages -y
3Unhold specific packages (if appropriate)

If you no longer need a package to be held, remove the hold:

bash
sudo apt-mark unhold package-name

For multiple packages:

bash
sudo apt-mark unhold package1 package2 package3
4Unhold all packages

To remove all holds at once:

bash
sudo apt-mark unhold $(sudo apt-mark showhold)

Use this carefully if you're unsure why packages were held.

5For unattended-upgrades, update configuration

If using unattended-upgrades, modify the config to allow held package changes:

bash
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Add or ensure this line exists:

bash
Unattended-Upgrade::Allow-Change-Held-Packages "true";

Advanced notes

Why packages are held:
Packages are often held to prevent breaking changes. Common reasons include:
- Version-specific application requirements (e.g., holding a database version for compatibility)
- Custom builds or patches that don't exist in repositories
- Testing upgrades in a staged manner
- Avoiding security tool updates that require configuration changes

Held packages vs broken packages:
Don't confuse "held packages" with "held broken packages". Held broken packages indicate unmet dependencies—these require apt install -f to fix.

Dependency resolution risk:
When you allow held packages to be changed, APT may upgrade them to versions that have different behavior or configuration requirements. Test upgrades in a non-production environment first.

Container and CI/CD contexts:
In Docker builds or CI pipelines, you may inherit held packages from base images or previous layers. Always check apt-mark showhold before upgrading, or explicitly unhold packages you want to update.

Frequently asked questions

What does "E" mean?
When you use apt-mark hold on a package, you're telling APT to protect that package from being automatically upgraded, downgraded, or removed during standard apt upgrade or apt dist-upgrade operations. This is useful when a package has version-specific requirements or compatibility constraints. However, when APT detects that a held package needs to be changed to satisfy dependencies during an upgrade (especially when run with -y for automatic approval), it refuses the operation with this error.
How do I fix "E"?
This error occurs when apt attempts to upgrade a package marked as held while using -y (automatic yes), but the --allow-change-held-packages flag was not provided. Held packages are protected from automatic changes to prevent dependency conflicts.
What causes "E"?
A package is marked as held using apt-mark hold but an upgrade requires changing it Running apt upgrade with -y flag without allowing held package changes Dependency resolution requires modifying a protected package
Is the "E" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading