diff --git a/modules/rke2/manifests/install.pp b/modules/rke2/manifests/install.pp
index 7c5b7b3..4630f3c 100644
--- a/modules/rke2/manifests/install.pp
+++ b/modules/rke2/manifests/install.pp
@@ -6,10 +6,11 @@ class rke2::install (
   Stdlib::HTTPUrl         $container_archive_source = $rke2::container_archive_source,
 ){
 
-  # versionlock rke2
+  # versionlock rke2 before install so the lock exists before any upgrade is attempted
   yum::versionlock{"rke2-${node_type}":
     ensure  => present,
     version => "${rke2_version}~${rke2_release}",
+    before  => Package["rke2-${node_type}"],
   }
 
   # install rke2
diff --git a/site/profiles/manifests/puppet/agent.pp b/site/profiles/manifests/puppet/agent.pp
index b8847c2..35d365c 100644
--- a/site/profiles/manifests/puppet/agent.pp
+++ b/site/profiles/manifests/puppet/agent.pp
@@ -60,10 +60,11 @@ class profiles::puppet::agent (
         require => Yumrepo[$use_yumrepo],
       }
 
-      # versionlock puppet-agent
+      # versionlock puppet-agent before install so the lock exists before any upgrade is attempted
       yum::versionlock{$use_package:
         ensure  => $agent_versionlock_ensure,
         version => $agent_versionlock_version,
+        before  => Package[$use_package],
       }
     }
     'Debian': {