How to Exclude or Skip a Package in yum and dnf Updates

Updated: 18 October 2026 · Applies to: dnf 4.14 (AlmaLinux 9.8), dnf 4.20 (AlmaLinux 10.2) and dnf5 5.4.6 (Fedora 44), where yum runs dnf, tested; Rocky Linux and RHEL 9 and 10 use the same dnf

To skip a package during one update, use --exclude (short form -x): yum update --exclude='kernel*' or dnf upgrade -x nginx. To exclude a package permanently, add exclude=nginx* to the [main] section of /etc/dnf/dnf.conf (/etc/yum.conf is a link to the same file). To keep the version you have now and still see the package normally, lock it with dnf versionlock add nginx.

On AlmaLinux, Rocky Linux and RHEL 9 and 10, /usr/bin/yum is a link to dnf-3 (dnf 4). On Fedora 44, both dnf and yum point to dnf5. The commands below work with either name; where dnf5 differs, it is noted.

1. Skip a package for one update

dnf upgrade --exclude='kernel*'
dnf upgrade -x gnutls -x 'glibc*'
dnf upgrade --exclude='gnutls,glibc*'

Put patterns with * in quotes so the shell does not expand them. Several patterns can be given with repeated -x or separated by commas; both forms gave the same result in our test. To see what would be left out, compare dnf check-update with and without the option. Lab example on AlmaLinux 10.2: dnf upgrade offered 12 packages, and with --exclude='glibc*' the summary showed:

Transaction Summary
Upgrade  9 Packages

The three glibc packages stay at their current version until you run an upgrade without the option. On Fedora 44 the same --exclude and -x options work with dnf5.

2. Exclude a package permanently (dnf.conf or yum.conf)

1. Open /etc/dnf/dnf.conf.
2. Add an exclude line in the [main] section. Separate several patterns with spaces or commas:

   [main]
   gpgcheck=1
   ...
   exclude=kernel* php*

3. Save the file. There is nothing to restart: the next dnf or yum command reads it.

dnf then ignores matching packages in every repository: no updates, and no new installs either. In the lab, installing an excluded package failed like this:

# dnf 4 (AlmaLinux 9 and 10)
All matches were filtered out by exclude filtering for argument: nginx
Error: Unable to find a match: nginx

# dnf5 (Fedora 44)
Failed to resolve the transaction:
Argument 'nginx' matches only excluded packages.

If you see these messages and did not expect them, check dnf.conf and the .repo files for an exclude line. To ignore the excludes for one command:

• dnf 4: dnf install --disableexcludes=main nginx (main for dnf.conf, a repository ID for that repository, or all).
• dnf5: dnf install --setopt=disable_excludes='*' nginx. dnf5 rejects --disableexcludes with Unknown argument.

dnf5 calls the option excludepkgs; in our test on Fedora 44, exclude= in dnf.conf was still accepted.

3. Exclude a package from one repository only

Useful when the same package is in two repositories and you want it from only one of them. Add exclude= to that repository's section in /etc/yum.repos.d/*.repo, or let dnf write it:

# dnf 4: writes exclude=nginx* into the [appstream] section
dnf config-manager --save --setopt=appstream.exclude='nginx*'
# remove it again (leaves an empty exclude= line)
dnf config-manager --save --setopt=appstream.exclude=

# dnf5: writes /etc/dnf/repos.override.d/99-config_manager.repo
dnf config-manager setopt fedora.excludepkgs='nginx*'
dnf config-manager unsetopt fedora.excludepkgs

To bypass it once on dnf 4, use the repository ID: --disableexcludes=appstream.

4. Lock the installed version with versionlock

An exclude hides a package completely. A version lock keeps the version that is installed now, and dnf versionlock list shows what you pinned on purpose. On AlmaLinux, Rocky Linux and RHEL, install the plugin first:

dnf install python3-dnf-plugin-versionlock
dnf versionlock add gnutls
dnf versionlock list
dnf versionlock delete gnutls     # allow updates again
dnf versionlock clear             # remove all locks

Lab output on AlmaLinux 9.8, where an update for gnutls was available:

# dnf versionlock add gnutls
Adding versionlock on: gnutls-0:3.8.10-8.el9_8.*
# dnf upgrade gnutls
Dependencies resolved.
Nothing to do.
Complete!

The locks are stored in /etc/dnf/plugins/versionlock.list. On Fedora 44, dnf versionlock worked without installing anything extra; dnf5 printed Adding versionlock on "glib2 = 2.88.3-1.fc44". and keeps the locks in /etc/dnf/versionlock.toml. For downgrading to an older version first, see How to Install, Downgrade or Lock a Specific Package Version with dnf (AlmaLinux, Rocky Linux, RHEL and Fedora).

5. "Skip" options that do something else

• --skip-broken skips packages whose dependencies cannot be resolved; it is not a way to choose what to leave out. On dnf5 it works with install but not with upgrade (Unknown argument "--skip-broken" for command "upgrade").
• --skip-unavailable (dnf5) lets a command continue when a named package does not exist.
• Module streams (AlmaLinux, Rocky Linux and RHEL 9 only): an enabled stream already fixes the major version, for example nginx 1.22, 1.24 or 1.26 in dnf module list nginx. Minor updates in the stream still arrive. AlmaLinux 10 has no modules (Error: No matching Modules to list).

Debian and Ubuntu

apt has no exclude list; it holds packages instead: apt-mark hold nginx, apt-mark showhold and apt-mark unhold nginx. Details: How to Install a Specific Package Version on Ubuntu and Debian with apt (Hold, Downgrade, Download).

Remember to unlock

Excluded and locked packages also miss security fixes. Keep a note of what you held back and why, and check it after each maintenance window. On a VPS, a short comment next to the exclude line in dnf.conf helps whoever looks after the server next.

Official documentation: DNF configuration reference (excludepkgs) and DNF versionlock plugin.