diff --git a/ci/setup-cfengine-build-host.sh b/ci/setup-cfengine-build-host.sh
index 683afe241..dc27f16bd 100755
--- a/ci/setup-cfengine-build-host.sh
+++ b/ci/setup-cfengine-build-host.sh
@@ -86,7 +86,12 @@ if [ -f /etc/os-release ]; then
     yum update --assumeyes
     alias software='yum install --assumeyes'
   elif grep -q debian /etc/os-release; then
-    DEBIAN_FRONTEND=noninteractive apt upgrade --yes && DEBIAN_FRONTEND=noninteractive apt autoremove --yes
+    # sometimes the /boot partition is too small to handle kernel upgrade regenerations of initrd and related files on ubuntu, so allow failure first
+    DEBIAN_FRONTEND=noninteractive apt upgrade --yes || true
+    DEBIAN_FRONTEND=noninteractive apt autoremove --yes
+    # and now perform the upgrade a second time after hopefully autoremove cleans up /boot partition of kernel files that cause failure
+    DEBIAN_FRONTEND=noninteractive apt upgrade --yes
+    DEBIAN_FRONTEND=noninteractive apt autoremove --yes
     alias software='DEBIAN_FRONTEND=noninteractive apt install --yes'
   elif grep -q suse /etc/os-release; then
     zypper -n update