diff --git a/internal/pkg/agent/application/actions/handlers/handler_action_upgrade.go b/internal/pkg/agent/application/actions/handlers/handler_action_upgrade.go
index 1520677f06b..601215bde78 100644
--- a/internal/pkg/agent/application/actions/handlers/handler_action_upgrade.go
+++ b/internal/pkg/agent/application/actions/handlers/handler_action_upgrade.go
@@ -50,11 +50,9 @@ func (h *Upgrade) Handle(ctx context.Context, a fleetapi.Action, ack acker.Acker
 		return fmt.Errorf("invalid type, expected ActionUpgrade and received %T", a)
 	}
 
-	asyncCtx, runAsync := h.getAsyncContext(ctx, a, ack)
-	if !runAsync {
-		return nil
-	}
-
+	// first send the action to any units that need to know of it
+	// and only when there is no error add the action in the h.bkgActions
+	// (through getAsyncContext) so it can be invoked
 	if h.tamperProtectionFn() {
 		// Find inputs that want to receive UPGRADE action
 		// Endpoint needs to receive a signed UPGRADE action in order to be able to uncontain itself
@@ -73,6 +71,11 @@ func (h *Upgrade) Handle(ctx context.Context, a fleetapi.Action, ack acker.Acker
 		}
 	}
 
+	asyncCtx, runAsync := h.getAsyncContext(ctx, a, ack)
+	if !runAsync {
+		return nil
+	}
+
 	go func() {
 		h.log.Infof("starting upgrade to version %s in background", action.Data.Version)
 		if err := h.coord.Upgrade(asyncCtx, action.Data.Version, action.Data.SourceURI, action, false, false); err != nil {