diff --git a/apps/settings/lib/Controller/AppSettingsController.php b/apps/settings/lib/Controller/AppSettingsController.php
index bd713cab2013a..92c973b2e61f4 100644
--- a/apps/settings/lib/Controller/AppSettingsController.php
+++ b/apps/settings/lib/Controller/AppSettingsController.php
@@ -650,6 +650,12 @@ public function uninstallApp(string $appId): JSONResponse {
 	public function updateApp(string $appId): JSONResponse {
 		$appId = $this->appManager->cleanAppId($appId);
 
+		// Don't try to update locked apps
+		$appsLocked = $this->config->getSystemValue('apps_locked', []);
+		if (in_array($appId, $appsLocked, true)) {
+			return new JSONResponse(['data' => ['message' => $this->l10n->t('App is locked, update skipped.')]], Http::STATUS_FORBIDDEN);
+		}
+
 		$this->config->setSystemValue('maintenance', true);
 		try {
 			$result = $this->installer->updateAppstoreApp($appId);
diff --git a/core/Command/App/Update.php b/core/Command/App/Update.php
index 71c7f84e5b091..f41305e13be32 100644
--- a/core/Command/App/Update.php
+++ b/core/Command/App/Update.php
@@ -11,6 +11,8 @@
 use OC\Installer;
 use OCP\App\AppPathNotFoundException;
 use OCP\App\IAppManager;
+use OCP\IConfig;
+use OCP\Server;
 use Psr\Log\LoggerInterface;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Input\InputArgument;
@@ -77,6 +79,10 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 		}
 
 		$return = 0;
+
+		$config = Server::get(IConfig::class);
+		$appsLocked = $config->getSystemValue('apps_locked', []);
+
 		foreach ($apps as $appId) {
 			$newVersion = $this->installer->isUpdateAvailable($appId, $input->getOption('allow-unstable'));
 			if ($newVersion) {
@@ -84,6 +90,12 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 				$output->writeln($appId . ' new version available: ' . $newVersion);
 
 				if (!$input->getOption('showonly')) {
+					// Don't try to update locked apps
+					if (in_array($appId, $appsLocked, true)) {
+						$output->writeln('Update skipped for locked app ' . $appId);
+						continue;
+					}
+
 					try {
 						$result = $this->installer->updateAppstoreApp($appId, $input->getOption('allow-unstable'));
 					} catch (\Exception $e) {
diff --git a/lib/private/Updater.php b/lib/private/Updater.php
index da7b52e549306..b6cd59496ffe1 100644
--- a/lib/private/Updater.php
+++ b/lib/private/Updater.php
@@ -373,7 +373,14 @@ private function isCodeUpgrade(): bool {
 	 * @throws \Exception
 	 */
 	private function upgradeAppStoreApps(array $apps, array $previousEnableStates = []): void {
+		$appsLocked = $this->config->getSystemValue('apps_locked', []);
+
 		foreach ($apps as $app) {
+			// Don't try to update locked apps
+			if (in_array($app, $appsLocked, true)) {
+				$this->log->info('Update skipped for locked app' . $app, ['app' => 'updater']);
+				continue;
+			}
 			try {
 				$this->emit('\OC\Updater', 'checkAppStoreAppBefore', [$app]);
 				if ($this->installer->isUpdateAvailable($app)) {