diff --git a/eng/dockerfile-templates/Dockerfile.linux.install-deps b/eng/dockerfile-templates/Dockerfile.linux.install-deps
index da785089fb..f4965ef725 100644
--- a/eng/dockerfile-templates/Dockerfile.linux.install-deps
+++ b/eng/dockerfile-templates/Dockerfile.linux.install-deps
@@ -108,5 +108,6 @@
     [
         "pkgs": pkgs,
         "pkg-mgr": when(isDistrolessAzureLinux && !isAzureLinux3, "dnf", when(isDistrolessAzureLinux, "tdnf", "")),
-        "pkg-mgr-opts": pkgMgrOpts
+        "pkg-mgr-opts": pkgMgrOpts,
+        "upgrade-pkgs": when(OS_VERSION = "azurelinux4.0", [caCertsPkg], [])
     ])}}
diff --git a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs
index da219b0201..1306c69cb3 100644
--- a/eng/dockerfile-templates/Dockerfile.linux.install-pkgs
+++ b/eng/dockerfile-templates/Dockerfile.linux.install-pkgs
@@ -3,6 +3,7 @@
         pkgs: list of packages to install
         pkg-mgr (optional): package manager to use
         pkg-mgr-opts (optional): additional options to pass to the package manager
+        upgrade-pkgs (optional): packages to upgrade in the DNF5 installation transaction
         no-clean (optional): skip package manager cleanup after install ^
 
     set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
@@ -11,19 +12,24 @@
     set isDnf to ARGS["pkg-mgr"] = "dnf" || (isAzureLinux && !isAzureLinux3 && ARGS["pkg-mgr"] != "tdnf") ^
     set isTdnf to ARGS["pkg-mgr"] = "tdnf" || (!isDnf && isAzureLinux) ^
     set isApk to ARGS["pkg-mgr"] = "apk" || isAlpine ^
+    set upgradePkgs to ARGS["upgrade-pkgs"] ^
     set appendPkgSuffix(pkg, index) to:{{
         _ Don't apply a space and continuation character after the package text if it's a comment or
           the last of the Alpine packages ^
         return find(pkg, "#") != 0 && !(isAlpine && index = len(ARGS["pkgs"]) - 1)
     }}
 }}{{
-if isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^
+if isDnf && len(upgradePkgs) > 0:dnf --refresh do -y{{ARGS["pkg-mgr-opts"]}} \
+        --action=install \^
+elif isDnf:dnf install -y{{ARGS["pkg-mgr-opts"]}} \^
 elif isApk:apk add --upgrade --no-cache{{ARGS["pkg-mgr-opts"]}} \^
 elif isTdnf:tdnf install -y{{ARGS["pkg-mgr-opts"]}} \^
 else:apt-get update \
     && apt-get install -y --no-install-recommends{{ARGS["pkg-mgr-opts"]}} \}}{{
     for index, pkg in ARGS["pkgs"]:
-        {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if !ARGS["no-clean"]:{{
+        {{pkg}}{{if appendPkgSuffix(pkg, index):{{if pkg != "": }}\}}}}{{if isDnf && len(upgradePkgs) > 0:
+        --action=upgrade \
+        {{join(upgradePkgs, " ")}} \}}{{if !ARGS["no-clean"]:{{
 if isTdnf:
     && tdnf clean all{{ARGS["pkg-mgr-opts"]}}^
 elif isDnf:
diff --git a/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile b/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile
index 85067aa6ee..f1fd35a1f2 100644
--- a/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile
+++ b/src/runtime-deps/10.0/azurelinux4.0/amd64/Dockerfile
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile b/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile
index 85067aa6ee..f1fd35a1f2 100644
--- a/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile
+++ b/src/runtime-deps/10.0/azurelinux4.0/arm64v8/Dockerfile
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile b/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile
index 85067aa6ee..f1fd35a1f2 100644
--- a/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile
+++ b/src/runtime-deps/11.0/azurelinux4.0/amd64/Dockerfile
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile b/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile
index 85067aa6ee..f1fd35a1f2 100644
--- a/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile
+++ b/src/runtime-deps/11.0/azurelinux4.0/arm64v8/Dockerfile
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt
index 85067aa6ee..f1fd35a1f2 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-amd64-Dockerfile.approved.txt
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt
index 85067aa6ee..f1fd35a1f2 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-10.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt
index 85067aa6ee..f1fd35a1f2 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-amd64-Dockerfile.approved.txt
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group
diff --git a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt
index 85067aa6ee..f1fd35a1f2 100644
--- a/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt
+++ b/tests/Microsoft.DotNet.Docker.Tests/Baselines/GeneratedArtifactTests/VerifyInternalDockerfilesOutput/runtime-deps-11.0-azurelinux4.0-arm64v8-Dockerfile.approved.txt
@@ -8,7 +8,8 @@ ENV \
     # Enable detection of running in a container
     DOTNET_RUNNING_IN_CONTAINER=true
 
-RUN dnf install -y \
+RUN dnf --refresh do -y \
+        --action=install \
         ca-certificates \
         \
         # .NET dependencies
@@ -18,6 +19,8 @@ RUN dnf install -y \
         libstdc++ \
         openssl-libs \
         tzdata \
+        --action=upgrade \
+        ca-certificates \
     && dnf clean all
 
 # Create a non-root user and group