diff --git a/CHANGELOG.md b/CHANGELOG.md
index feef87d9..011390a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **role:php**: The `php:update` tag now refreshes the apt cache before the upgrade on Debian-family hosts, so it reliably installs the latest packages (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own.
+* **role:monitoring_plugins**: The role now refreshes the apt cache before installing the monitoring-plugins package on Debian-family hosts, so it reliably installs the latest version (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own.
+* **role:mariadb_server**: The `mariadb_server:upgrade` tag now refreshes the apt cache before the upgrade on Debian-family hosts, so it reliably installs the latest packages (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own.
 * **role:system_update**: The update and security-update jobs no longer send a failure mail when a mirror hiccups briefly (e.g. Rocky's mirrorlist intermittently returning "No URLs in mirrorlist"). Repository metadata is now refreshed with a few retries before updates are applied, so short-lived upstream outages are ridden out instead of paging you.
 * **role:monitoring_plugins, role:mod_maxminddb**: The role no longer aborts at start with an `undefined` error demanding a variable that has an OS-specific default (`monitoring_plugins__icinga_user` respectively `mod_maxminddb__apache_conf_modules_d`). The role now derives the default on its own again, so there is no need to set the variable in the inventory.
 * **role:monitoring_plugins**: A source install no longer aborts on RHEL 8. The role used to fail because the system Python 3.6 is older than the required 3.9; it now installs and uses Python 3.9 automatically.
diff --git a/roles/mariadb_server/tasks/main.yml b/roles/mariadb_server/tasks/main.yml
index 096e5533..949d0285 100644
--- a/roles/mariadb_server/tasks/main.yml
+++ b/roles/mariadb_server/tasks/main.yml
@@ -42,6 +42,16 @@
         - 'mariadb-server'
       state: 'absent'
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'Install latest mariadb-server' # noqa package-latest (latest is necessary for upgrade)
     ansible.builtin.package:
       name:
diff --git a/roles/monitoring_plugins/tasks/linux-package.yml b/roles/monitoring_plugins/tasks/linux-package.yml
index f069fe3a..652d7a66 100644
--- a/roles/monitoring_plugins/tasks/linux-package.yml
+++ b/roles/monitoring_plugins/tasks/linux-package.yml
@@ -21,6 +21,16 @@
 
 - block:
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'install linuxfabrik-monitoring-plugins{{ __monitoring_plugins__package_version_separator }}{{ monitoring_plugins__version }}*' # noqa package-latest
     ansible.builtin.package:
       name:
diff --git a/roles/php/tasks/main.yml b/roles/php/tasks/main.yml
index 8642121a..2e0d9e82 100644
--- a/roles/php/tasks/main.yml
+++ b/roles/php/tasks/main.yml
@@ -27,6 +27,16 @@
 
 - block:
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'Update php php-fpm composer' # noqa package-latest (we explicitly want latest here)
     ansible.builtin.package:
       name:
@@ -88,6 +98,16 @@
     ansible.builtin.debug:
       var: 'php__modules__combined_var'
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'Update PHP modules' # noqa package-latest (we explicitly want latest here)
     # providing the packages as a list is much more faster than looping for each
     ansible.builtin.package: