diff --git a/cmd/stackpack/stackpack_upgrade.go b/cmd/stackpack/stackpack_upgrade.go
index c1d85da8..e504a71a 100644
--- a/cmd/stackpack/stackpack_upgrade.go
+++ b/cmd/stackpack/stackpack_upgrade.go
@@ -40,7 +40,7 @@ sts stackpack upgrade --name kubernetes --wait`,
 	common.AddRequiredNameFlagVar(cmd, &args.TypeName, "Name of the StackPack")
 	pflags.EnumVar(cmd.Flags(), &args.UnlockedStrategy,
 		UnlockedStrategyFlag,
-		"",
+		"fail",
 		UnlockedStrategyChoices,
 		"Strategy use to upgrade StackPack instance"+
 			fmt.Sprintf(" (must be { %s })", strings.Join(UnlockedStrategyChoices, " | ")),
diff --git a/cmd/stackpack/stackpack_upgrade_test.go b/cmd/stackpack/stackpack_upgrade_test.go
index 8b466293..b8e4f7dc 100644
--- a/cmd/stackpack/stackpack_upgrade_test.go
+++ b/cmd/stackpack/stackpack_upgrade_test.go
@@ -70,6 +70,19 @@ func TestStackpackUpgradePrintToJson(t *testing.T) {
 	assert.Equal(t, expectedJsonCalls, *cli.MockPrinter.PrintJsonCalls)
 }
 
+func TestStackpackUpgradeDefaultsUnlockedStrategy(t *testing.T) {
+	cli, cmd := setupStackPackUpgradeCmd(t)
+	di.ExecuteCommandWithContextUnsafe(&cli.Deps, cmd, "upgrade", "--name", "zabbix")
+
+	defaultStrategy := "fail"
+	assert.Equal(t,
+		[]stackstate_api.UpgradeStackPackCall{{
+			PstackPackName: "zabbix",
+			Punlocked:      &defaultStrategy,
+		}},
+		*cli.MockClient.ApiMocks.StackpackApi.UpgradeStackPackCalls)
+}
+
 func TestStackpackUpgradeHasWaitFlags(t *testing.T) {
 	cli := di.NewMockDeps(t)
 	cmd := StackpackUpgradeCommand(&cli.Deps)