diff --git a/tasks/main.yml b/tasks/main.yml
index 7a1168c..bc0ed71 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -20,6 +20,14 @@
   notify:
     - 'ensure_os_patch.package_facts'
     - 'ensure_os_patch.service_facts'
+- name: 'ensure patch'
+  when:
+    - ansible_system == 'Linux'
+    - ansible_pkg_mgr == 'apt'
+  apt:
+    autoclean: 'yes'
+    autoremove: 'yes'
+    upgrade: 'dist'
 - name: 'flush handlers'
   meta: 'flush_handlers'