diff --git a/.gitlab-ci/packet.yml b/.gitlab-ci/packet.yml
index 186240ef1ac9ccb4556f5158a5bfa8c39e9c124f..1faf5b9a90f704ad0f26d22db7f8b3a0d1eebbb0 100644
--- a/.gitlab-ci/packet.yml
+++ b/.gitlab-ci/packet.yml
@@ -173,7 +173,7 @@ packet_fedora30-cilium-containerd:
 packet_centos7-weave-upgrade-ha:
   stage: deploy-part3
   extends: .packet
-  when: on_success
+  when: manual
   variables:
     UPGRADE_TEST: basic
     MITOGEN_ENABLE: "false"
@@ -181,7 +181,7 @@ packet_centos7-weave-upgrade-ha:
 packet_debian9-calico-upgrade:
   stage: deploy-part3
   extends: .packet
-  when: on_success
+  when: manual
   variables:
     UPGRADE_TEST: graceful
     MITOGEN_ENABLE: "false"
@@ -189,7 +189,7 @@ packet_debian9-calico-upgrade:
 packet_debian9-calico-upgrade-once:
   stage: deploy-part3
   extends: .packet
-  when: on_success
+  when: manual
   variables:
     UPGRADE_TEST: graceful
     MITOGEN_ENABLE: "false"
diff --git a/roles/container-engine/docker/defaults/main.yml b/roles/container-engine/docker/defaults/main.yml
index b0cb6bb1e34a3bf5961d2334c4fb28c9dae1e09e..4f74974134afdeff97bb414d4a0b76365b017c73 100644
--- a/roles/container-engine/docker/defaults/main.yml
+++ b/roles/container-engine/docker/defaults/main.yml
@@ -1,5 +1,6 @@
 ---
 docker_version: '18.09'
+docker_cli_version: "{{ 'latest' if docker_version != 'latest' and docker_version is version('18.09', '<') else docker_version }}"
 docker_selinux_version: '17.03'
 
 docker_package_info:
diff --git a/roles/container-engine/docker/vars/debian.yml b/roles/container-engine/docker/vars/debian.yml
index 6fa34358e91fb59e6d6d127e4cb142bec33de4ca..555cf52021c1a49e4bb49766314f2396002b0023 100644
--- a/roles/container-engine/docker/vars/debian.yml
+++ b/roles/container-engine/docker/vars/debian.yml
@@ -16,9 +16,16 @@ docker_versioned_pkg:
   'stable': docker-ce=5:18.09.7~3-0~debian-{{ ansible_distribution_release|lower }}
   'edge': docker-ce=5:19.03.7~3-0~debian-{{ ansible_distribution_release|lower }}
 
+docker_cli_versioned_pkg:
+  'latest': docker-ce-cli
+  '18.09': docker-ce-cli=5:18.09.9~3-0~debian-{{ ansible_distribution_release|lower }}
+  '19.03': docker-ce-cli=5:19.03.9~3-0~debian-{{ ansible_distribution_release|lower }}
+
 docker_package_info:
   pkg_mgr: apt
   pkgs:
+    - name: "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
+      force: yes
     - name: "{{ docker_versioned_pkg[docker_version | string] }}"
       force: yes
 
diff --git a/roles/container-engine/docker/vars/fedora.yml b/roles/container-engine/docker/vars/fedora.yml
index 6befdd97e071ec0b3b2f5ada4f2386f4ded37c6b..a1302296e41a482fe7b66d9fca52b3bda08731ff 100644
--- a/roles/container-engine/docker/vars/fedora.yml
+++ b/roles/container-engine/docker/vars/fedora.yml
@@ -11,10 +11,17 @@ docker_versioned_pkg:
   '18.09': docker-ce-18.09.7-3.fc{{ ansible_distribution_major_version }}
   '19.03': docker-ce-19.03.8-3.fc{{ ansible_distribution_major_version }}
 
+docker_cli_versioned_pkg:
+  'latest': docker-ce-cli
+  '18.09': docker-ce-cli-19.03.8-3.fc{{ ansible_distribution_major_version }}
+  '19.03': docker-ce-cli-19.03.9-3.fc{{ ansible_distribution_major_version }}
+
 # Fedora 30/31 don't provide packages for docker 18.0x ...
 docker_version: "19.03"
+docker_cli_version: "19.03"
 
 docker_package_info:
   pkg_mgr: dnf
   pkgs:
+    - name: "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
     - name: "{{ docker_versioned_pkg[docker_version | string] }}"
diff --git a/roles/container-engine/docker/vars/redhat.yml b/roles/container-engine/docker/vars/redhat.yml
index 7d3170786e9d1764c4b8df32cb8dfd0033bb7f13..b568a6a43d6e63bf1cc0ec9ef93b27e646622666 100644
--- a/roles/container-engine/docker/vars/redhat.yml
+++ b/roles/container-engine/docker/vars/redhat.yml
@@ -16,6 +16,11 @@ docker_versioned_pkg:
   'stable': docker-ce-18.09.9-3.el7
   'edge': docker-ce-19.03.8-3.el7
 
+docker_cli_versioned_pkg:
+  'latest': docker-ce-cli
+  '18.09': docker-ce-cli-18.09.9-3.el7
+  '19.03': docker-ce-cli-19.03.9-3.el7
+
 docker_selinux_versioned_pkg:
   'latest': docker-ce-selinux-17.03.3.ce-1.el7
   '17.03': docker-ce-selinux-17.03.3.ce-1.el7
@@ -30,13 +35,15 @@ docker_pkgs_use_docker_ce:
     yum_conf: "{{ docker_yum_conf }}"
 
 docker_pkgs:
+  - name: "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
+    yum_conf: "{{ docker_yum_conf }}"
   - name: "{{ docker_versioned_pkg[docker_version | string] }}"
     yum_conf: "{{ docker_yum_conf }}"
 
 docker_package_info:
   pkg_mgr: yum
   pkgs: |-
-    {%- if docker_version is version('17.04', '<') -%}
+    {%- if docker_version != "latest" and docker_version is version('17.04', '<') -%}
     {{ docker_pkgs_use_docker_ce }}
     {%- else -%}
     {{ docker_pkgs }}
diff --git a/roles/container-engine/docker/vars/ubuntu-amd64.yml b/roles/container-engine/docker/vars/ubuntu-amd64.yml
index ce26c567ea5ca2883d3ac3f48558e640f4e4b53c..2222bbcef0c399fe988a1b4f0903b41008811376 100644
--- a/roles/container-engine/docker/vars/ubuntu-amd64.yml
+++ b/roles/container-engine/docker/vars/ubuntu-amd64.yml
@@ -16,9 +16,16 @@ docker_versioned_pkg:
   'stable': docker-ce=5:18.09.7~3-0~ubuntu-{{ ansible_distribution_release|lower }}
   'edge': docker-ce=5:19.03.7~3-0~ubuntu-{{ ansible_distribution_release|lower }}
 
+docker_cli_versioned_pkg:
+  'latest': docker-ce-cli
+  '18.09': docker-ce-cli=5:18.09.9~3-0~ubuntu-{{ ansible_distribution_release|lower }}
+  '19.03': docker-ce-cli=5:19.03.9~3-0~ubuntu-{{ ansible_distribution_release|lower }}
+
 docker_package_info:
   pkg_mgr: apt
   pkgs:
+    - name: "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
+      force: yes
     - name: "{{ docker_versioned_pkg[docker_version | string] }}"
       force: yes
 
diff --git a/roles/container-engine/docker/vars/ubuntu-arm64.yml b/roles/container-engine/docker/vars/ubuntu-arm64.yml
index 3021837e0e2086854d2636d8fc8fc621ec71ad67..b24511b941f8951a78b7c8078a804cf905728993 100644
--- a/roles/container-engine/docker/vars/ubuntu-arm64.yml
+++ b/roles/container-engine/docker/vars/ubuntu-arm64.yml
@@ -12,9 +12,16 @@ docker_versioned_pkg:
   'stable': docker-ce=5:18.09.7~3-0~ubuntu-{{ ansible_distribution_release|lower }}
   'edge': docker-ce=5:19.03.7~3-0~ubuntu-{{ ansible_distribution_release|lower }}
 
+docker_cli_versioned_pkg:
+  'latest': docker-ce-cli
+  '18.09': docker-ce-cli=5:18.09.9~3-0~ubuntu-{{ ansible_distribution_release|lower }}
+  '19.03': docker-ce-cli=5:19.03.9~3-0~ubuntu-{{ ansible_distribution_release|lower }}
+
 docker_package_info:
   pkg_mgr: apt
   pkgs:
+    - name: "{{ docker_cli_versioned_pkg[docker_cli_version | string] }}"
+      force: yes
     - name: "{{ docker_versioned_pkg[docker_version | string] }}"
       force: yes