diff --git a/cli/internal/config/nodebootstrap/assets/script.sh.tmpl b/cli/internal/config/nodebootstrap/assets/script.sh.tmpl
index e4eeea9..b75b657 100644
--- a/cli/internal/config/nodebootstrap/assets/script.sh.tmpl
+++ b/cli/internal/config/nodebootstrap/assets/script.sh.tmpl
@@ -25,7 +25,7 @@ apt-get update -y
 apt-get upgrade -y
 {{- end }}
 {{- if .Packages }}
-apt-get install -y {{ join .Packages " " }}
+apt-get install -y --allow-change-held-packages {{ join .Packages " " }}
 {{- end }}
 {{- end }}
 {{- if .FQDN }}
diff --git a/cli/internal/config/nodebootstrap/script_test.go b/cli/internal/config/nodebootstrap/script_test.go
index 3166125..22743c4 100644
--- a/cli/internal/config/nodebootstrap/script_test.go
+++ b/cli/internal/config/nodebootstrap/script_test.go
@@ -36,7 +36,7 @@ func Test_marshalScript_basic(t *testing.T) {
 		"#!/bin/bash",
 		"set -euo pipefail",
 		"apt-get update -y",
-		"apt-get install -y curl",
+		"apt-get install -y --allow-change-held-packages curl",
 		"mkdir -p '/tmp'",
 		`cat <<'EOF' > '/tmp/config.json'`,
 		`{"key":"value"}`,