diff --git a/debian/apt.systemd.daily b/debian/apt.systemd.daily
index a8d98494b..ee9e5f874 100755
--- a/debian/apt.systemd.daily
+++ b/debian/apt.systemd.daily
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 #set -e
 #
 # This file understands the following apt configuration variables:
@@ -292,6 +292,13 @@ debug_echo()
 
 # ------------------------ main ----------------------------
 
+eval $(apt-config shell StateDir Dir::State/d)
+exec {LOCKFD}>${StateDir}/daily_lock
+if test -z "$LOCKFD" || ! flock -w 3600 $LOCKFD; then
+    echo "E: Could not acquire lock" >&2
+    exit 1
+fi
+
 if test -r /var/lib/apt/extended_states; then
     # Backup the 7 last versions of APT's extended_states file
     # shameless copy from dpkg cron
@@ -423,9 +430,9 @@ if [ "$1" = "update" -o -z "$1" ] ; then
     DOWNLOAD_UPGRADEABLE_STAMP=/var/lib/apt/periodic/download-upgradeable-stamp
     if [ $UPDATED -eq 1 ] && check_stamp $DOWNLOAD_UPGRADEABLE_STAMP $DownloadUpgradeableInterval; then
 	if [ $Debdelta -eq 1 ]; then
-	    debdelta-upgrade >/dev/null 2>&1 || true
+	    debdelta-upgrade >/dev/null 2>&1 $LOCKFD>&- || true
 	fi
-	if  eval apt-get $XAPTOPT -y -d dist-upgrade $XSTDERR; then
+	if  eval apt-get $XAPTOPT -y -d dist-upgrade $XSTDERR $LOCKFD>&-; then
 	    update_stamp $DOWNLOAD_UPGRADEABLE_STAMP
 	    debug_echo "download upgradable (success)"
 	else
@@ -436,7 +443,7 @@ if [ "$1" = "update" -o -z "$1" ] ; then
     fi
 
     if which unattended-upgrade >/dev/null 2>&1 && check_stamp $DOWNLOAD_UPGRADEABLE_STAMP $UnattendedUpgradeInterval; then
-	if unattended-upgrade -d $XUUPOPT; then
+	if unattended-upgrade -d $XUUPOPT $LOCKFD>&-; then
 	    update_stamp $DOWNLOAD_UPGRADEABLE_STAMP
 	    debug_echo "unattended-upgrade -d (success)"
 	else
@@ -451,7 +458,7 @@ if [ "$1" = "install" -o -z "$1" ] ; then
     # auto upgrade all upgradeable packages
     UPGRADE_STAMP=/var/lib/apt/periodic/upgrade-stamp
     if which unattended-upgrade >/dev/null 2>&1 && check_stamp $UPGRADE_STAMP $UnattendedUpgradeInterval; then
-	if unattended-upgrade $XUUPOPT; then
+	if unattended-upgrade $XUUPOPT $LOCKFD>&-; then
 	    update_stamp $UPGRADE_STAMP
 	    debug_echo "unattended-upgrade (success)"
 	else