diff --git a/plinth/modules/upgrades/__init__.py b/plinth/modules/upgrades/__init__.py
index f137b8578..e4797d7a3 100644
--- a/plinth/modules/upgrades/__init__.py
+++ b/plinth/modules/upgrades/__init__.py
@@ -55,7 +55,7 @@ class UpgradesApp(app_module.App):
 
     app_id = 'upgrades'
 
-    _version = 18
+    _version = 19
 
     can_be_disabled = False
 
diff --git a/plinth/modules/upgrades/privileged.py b/plinth/modules/upgrades/privileged.py
index cedc432c6..3be661812 100644
--- a/plinth/modules/upgrades/privileged.py
+++ b/plinth/modules/upgrades/privileged.py
@@ -43,6 +43,15 @@ Explanation: python3-canonicaljson >= 2.0.0~
 Package: python3-canonicaljson
 Pin: release n=bookworm-backports
 Pin-Priority: 500
+
+Explanation: Prevent installation of Samba Active Directory. AD package depends
+Explanation: on winbind, which breaks FreedomBox LDAP PAM configuration.
+Explanation: In Debian Trixie, AD server package is required by samba package,
+Explanation: but is not required to run Samba file server. See also Debian
+Explanation: bug report 1099755.
+Package: samba-ad-dc
+Pin: release *
+Pin-Priority: -1
 '''