Phased updates are regular Ubuntu updates released to a growing share of machines instead of everyone at once. Ubuntu states that security updates are never phased. If apt upgrade says a package is kept back, it is often a phased rollout, and the package will arrive on its own.
How phasing works
Ubuntu's documentation describes it simply: a small group of machines gets an update first, and the group grows as the update proves stable. The goal is to limit the damage of a bad update.
Which group you fall into is decided on your machine. According to the same page, apt uses a value derived from the machine ID, the package name and the package version, and no identifying information is sent to the server. Two hosts can therefore receive the same update on different days, and the same host can be early for one package and late for another.
Why this matters for security teams
If you run a fleet and assume every host receives each update on the same day, phasing can explain why two identical servers show different package versions. It also explains a pattern that looks like patch drift: a host "kept back" a package that its neighbour already has.
The reassuring part is the rule on security fixes. Because security updates are never phased, an advisory driven update should reach all hosts as soon as it is available. Phased packages are routine bugfix updates.
How to check a specific package
Run apt policy on the package. A phased version shows a label such as phased 20 percent.
apt policy package-name
apt list --upgradable
If a package appears under "kept back" and apt policy shows a phased label, wait. Ubuntu notes you can safely ignore the message and the update will install once the phasing completes.
Should you turn phasing off?
Ubuntu documents how: create a file in /etc/apt/apt.conf.d and set both Always-Include-Phased-Updates options to true. The page also warns that if an update is broken, you will almost always be in the first set to get it, and it does not recommend turning phasing off for newer users.
A good rule for teams:
| Environment | Suggested stance |
|---|---|
| Production | Leave phasing on. It is a free canary. |
| A staging host | Consider turning it off to catch bad updates before production sees them. |
| A host that must match a vendor requirement | Turn it off for that host only, and write down why. |
That staging idea mirrors a deliberate canary strategy, covered in canary patch rollouts.
Do not force it with apt install
Ubuntu discourages installing a held back package by name. If a package is held back for a reason other than phasing, apt may remove other packages to complete the request, so review the proposed changes first. Compare with the behaviour in apt upgrade versus full-upgrade.
Quick check
Are security updates ever phased?
No. Ubuntu's documentation says security updates are never phased.
Does phasing send my machine information to Canonical?
Ubuntu says the phasing decision is made on the client using the machine ID, package name and version, and no identifying information is sent to the server.
How do I see if a package is phased?
Use apt policy on the package. A phased version shows a label such as phased 20 percent.
Safeguard keeps an inventory of installed packages and flags advisories against them, so version drift between hosts is visible. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
