diff --git a/cookbooks/security_updates/recipes/default.rb b/cookbooks/security_updates/recipes/default.rb
index e60f8745..1210915f 100644
--- a/cookbooks/security_updates/recipes/default.rb
+++ b/cookbooks/security_updates/recipes/default.rb
@@ -74,6 +74,7 @@
 
 package 'app-misc/ca-certificates' do
   version '20210119.3.66'
+  action :upgrade
 end
 
 execute "update-ca-certificates --fresh" do