How do you upgrade Jenkins to a new LTS without breaking builds?

To upgrade Jenkins without breaking builds, back up the home directory, read the upgrade guide for every LTS line you are crossing, test on a copy with your real plugins, check the Java version, then cut over. Skipping lines is allowed, but you must read each skipped guide.

Know what an LTS is

Jenkins offers two release lines. A weekly release ships each week. An LTS release is selected every 12 weeks from the regular stream as the stable version for that period. Production controllers normally follow LTS, using the stable package repositories.

The upgrade guide is organized by LTS line, and each section covers the move from the previous one. Recent lines listed at the time of writing are 2.541.x, 2.555.x, 2.568.x and 2.580.x. If you skip releases, the guide tells you to read the sections for everything in between.

Steps

1. Inventory. Record the current Jenkins version, Java version, installed plugins with versions, and agent versions.
2. Back up. Copy the home directory, keeping the controller key separate and secure (see the backup post linked below).
3. Read the guides. For each LTS line between you and the target, read the upgrade notes for changed defaults and removed features.
4. Check Java. Confirm the target works with a supported Java version. An unsupported one stops the controller from running.
5. Build a copy. Restore the backup onto a staging controller on the new version.
6. Update plugins. On the Updates tab, install updates. The Update Center only offers the latest release of each plugin, so an older one needs a manual install.
7. Test. Run representative pipelines, including ones that use credentials, shared libraries and script approval.
8. Cut over. Schedule a window, repeat on production, and keep the pre-upgrade backup until jobs have run cleanly for a while.

Common ways upgrades go wrong

• A plugin built for an older core no longer loads.
• A feature moved from core into a plugin, and an implied dependency was missed.
• Java was left on an old version and the service will not start. On Debian and Ubuntu, install Java before Jenkins.
• A setting that used to be optional became always on. Agent to controller access control, for example, has been always enabled since 2.326.

Why this matters for security

Fixes only reach you if you can take them. Controllers that skip upgrades for years end up with a large gap, and every extra LTS line means more notes to read. Small, regular upgrades are easier than one big jump.

Try it yourself

The demo shows how a fix available now is surfaced and tracked.

Click through it at your own pace, or open it full screen.

Where Safeguard fits

Safeguard scans dependencies and can open fix pull requests for your code, with automatic fixes off by default. Try the free scan. For the backup step, see what to back up from Jenkins home.

Quick check

Sources

• Jenkins: LTS upgrade guide
• Jenkins: Installing on Linux
• Jenkins: Managing plugins
• Jenkins: Controller isolation

Last reviewed: 19 October 2026.