diff --git a/pkg/cidata/cidata.TEMPLATE.d/boot/00-reboot-if-required.sh b/pkg/cidata/cidata.TEMPLATE.d/boot/00-reboot-if-required.sh
index fe75c1ae72e..bd1e502f381 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/boot/00-reboot-if-required.sh
+++ b/pkg/cidata/cidata.TEMPLATE.d/boot/00-reboot-if-required.sh
@@ -1,19 +1,34 @@
-#!/bin/sh
+#!/bin/bash
 
 # SPDX-FileCopyrightText: Copyright The Lima Authors
 # SPDX-License-Identifier: Apache-2.0
 
 set -eux
 
+[ "$LIMA_CIDATA_UPGRADE_PACKAGES" = "1" ] || exit 0
+
 # Check if cloud-init forgot to reboot_if_required
 # (only implemented for apt at the moment, not dnf)
 
 if command -v dnf >/dev/null 2>&1; then
 	# dnf-utils needs to be installed, for needs-restarting
 	if dnf -h needs-restarting >/dev/null 2>&1; then
-		# needs-restarting returns "false" if needed (!)
-		if ! dnf needs-restarting -r >/dev/null 2>&1; then
-			systemctl reboot
+		# check-update returns "false" (100) if updates (!)
+		set +e
+		dnf check-update >/dev/null
+		if [ "$?" != "1" ]; then
+			# needs-restarting messages are translated _()
+			export LC_ALL=C.UTF-8
+			logfile=$(mktemp)
+			# needs-restarting returns "false" if needed (!)
+			set -o pipefail
+			dnf needs-restarting -r | tee "$logfile"
+			if [ "$?" = "1" ]; then
+				if grep -q "Reboot is required" "$logfile"; then
+					systemctl reboot
+				fi
+			fi
+			rm "$logfile"
 		fi
 	fi
 fi
diff --git a/pkg/cidata/cidata.TEMPLATE.d/lima.env b/pkg/cidata/cidata.TEMPLATE.d/lima.env
index 8cd9453ccdc..4c78fe814a6 100644
--- a/pkg/cidata/cidata.TEMPLATE.d/lima.env
+++ b/pkg/cidata/cidata.TEMPLATE.d/lima.env
@@ -32,6 +32,11 @@ LIMA_CIDATA_YQ_PROVISION_{{$yqProvision.FileName}}_PATH={{$yqProvision.Path}}
 LIMA_CIDATA_YQ_PROVISION_{{$yqProvision.FileName}}_PERMISSIONS={{$yqProvision.Permissions}}
 {{- end}}
 LIMA_CIDATA_GUEST_INSTALL_PREFIX={{ .GuestInstallPrefix }}
+{{- if .UpgradePackages}}
+LIMA_CIDATA_UPGRADE_PACKAGES=1
+{{- else}}
+LIMA_CIDATA_UPGRADE_PACKAGES=
+{{- end}}
 {{- if .Containerd.User}}
 LIMA_CIDATA_CONTAINERD_USER=1
 {{- else}}