diff --git a/src/etc/rc.syshook.d/early/05-upgrade b/src/etc/rc.syshook.d/early/05-upgrade
index fdc508260f5..c75ec2fcfe2 100755
--- a/src/etc/rc.syshook.d/early/05-upgrade
+++ b/src/etc/rc.syshook.d/early/05-upgrade
@@ -3,8 +3,17 @@
 # Perform major updates
 
 for STAGE in K B P; do
-	if opnsense-update -${STAGE}; then
+	opnsense-update -${STAGE}
+	STATUS=${?}
+
+	if [ "${STATUS}" -eq 0 ]; then
 		echo "Rebooting now."
 		reboot
+		break
+	elif [ "${STATUS}" -ne 1 ]; then
+		# the stage was pending but could not be applied; the
+		# stages behind it must not run on top of the damage
+		echo "Upgrade stage ${STAGE} failed (${STATUS}), aborting."
+		break
 	fi
 done
diff --git a/src/opnsense/scripts/firmware/upgrade.sh b/src/opnsense/scripts/firmware/upgrade.sh
index aea4e5733fe..149f4ef4424 100755
--- a/src/opnsense/scripts/firmware/upgrade.sh
+++ b/src/opnsense/scripts/firmware/upgrade.sh
@@ -31,11 +31,11 @@ REQUEST="UPGRADE"
 
 if output_cmd opnsense-update -u; then
 	if output_cmd /usr/local/etc/rc.syshook upgrade; then
-		# pending kernel applies before reboot
-		if output_cmd opnsense-update -K -c; then
-			output_cmd opnsense-update -K
+		# pending kernel applies before reboot, but if that apply
+		# fails rebooting would only make matters worse
+		if ! output_cmd opnsense-update -K -c || output_cmd opnsense-update -K; then
+			output_reboot keep-log
 		fi
-		output_reboot keep-log
 	fi
 
 	output_txt "The upgrade was aborted due to an error."