diff --git a/CHANGELOG.md b/CHANGELOG.md
index 94442132..34c58cde 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ The **patch** part changes incrementally at each release.
 * elasticsearch: add http.publish_host variable
 * evoacme: disable old certbot cron also in cron.daily
 * evolinux-base: add mail related aliases
+* generate-ldif: detect installed packages even if "held" by APT
 * java: support for Oracle JRE
 * kibana: log messages go to /var/log/kibana/kibana.log
 * metricbeat: add a role (copied from filebeat)
diff --git a/generate-ldif/templates/generateldif.sh.j2 b/generate-ldif/templates/generateldif.sh.j2
index f0cdd233..73fe88c8 100755
--- a/generate-ldif/templates/generateldif.sh.j2
+++ b/generate-ldif/templates/generateldif.sh.j2
@@ -6,7 +6,7 @@ if [ $(id -u) != 0 ]; then
 fi
 
 is_pkg_installed() {
-    dpkg -l "$1" 2>/dev/null | grep -q '^ii'
+    dpkg -l "$1" 2>/dev/null | grep -q -E '^(i|h)i'
 }
 
 get_pkg_version() {