diff --git a/CHANGELOG.md b/CHANGELOG.md
index bbeebf5a..d58a94b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ The **patch** part changes incrementally at each release.
 
 ### Changed
 
+* listupgrade: upstream release 21.06.3
+
 ### Fixed
 
 * certbot: sync_remote excludes itself
diff --git a/listupgrade/files/listupgrade.sh b/listupgrade/files/listupgrade.sh
index 3c64f37e..0b682fed 100644
--- a/listupgrade/files/listupgrade.sh
+++ b/listupgrade/files/listupgrade.sh
@@ -7,7 +7,7 @@
 # - 60 : current release is not in the $r_releases list
 # - 70 : at least an upgradable package is not in the $r_packages list
 
-VERSION="21.06.2"
+VERSION="21.06.3"
 
 show_version() {
     cat <<END
@@ -121,7 +121,7 @@ EOT
 # are executed if they are executable
 # and if their name doesn't contain a dot
 exec_hooks_in_dir() {
-    hooks=$(find "${1}" -type f -executable -not -name '*.*')
+    hooks=$(find "${1}" -type f -executable -not -name '*.* -print0 | sort --zero-terminated --dictionary-order | xargs --no-run-if-empty --null --max-args=1')
     for hook in ${hooks}; do
         if ! cron_mode; then
             printf "Running '%s\`\n" "${hook}"
@@ -178,13 +178,14 @@ main() {
         echo 'Aucun' >"${packagesHold}"
     fi
 
+    local_release=$(cut -f 1 -d . </etc/debian_version)
+
     if force_mode; then
         if ! cron_mode; then
             echo "Force mode is enabled, as if every release/package is available for upgrade."
         fi
     else
         fetch_upgrade_info
-        local_release=$(cut -f 1 -d . </etc/debian_version)
 
         # Exit if skip_releases or skip_packages in upgrade info file are set to all.
         if [ "${r_skip_releases}" = "all" ] || [ "${r_skip_packages}" = "all" ]; then