diff --git a/scripts/prt-auf b/scripts/prt-auf
index fa4f310..3ca030a 100755
--- a/scripts/prt-auf
+++ b/scripts/prt-auf
@@ -658,12 +658,11 @@ sub up_inst {  # returns scalar references to five arrays
   # filter out the invalid ports if deporder() didn't do so already
   @targets = grep { ($V_REPO{$_}) } @targets if ($type eq "grpinst");
 
-  # exempt any locked ports from an sysup operation
-  %EXEMPT = map { $_ => 0 } @LOCKED;
+  # exempt any locked ports from an update operation
+  %EXEMPT = map { $_ => 1 } @LOCKED;
   %WANTED = map { $_ => 1 } @requested;
-  if ($action eq "sysup") { @targets = grep {! $EXEMPT{$_}} @targets;
-  } else {
-  @targets = grep {(! $EXEMPT{$_}) or ($WANTED{$_})} @targets;
+  if ($action =~ /^(update|install|depinst)$/) {
+      @targets = grep {(! $EXEMPT{$_}) or ($WANTED{$_})} @targets;
   }
 
   # first determine the directories from which pkgmk must be called,
@@ -735,6 +734,7 @@ sub up_inst {  # returns scalar references to five arrays
 sub sysup {
   my @targets; my $v_repo;
   foreach my $p (keys %V_INST) {
+    next if grep /$p/, @LOCKED;
     $v_repo = ($V_REPO{$p}) ? $V_REPO{$p} : "MISSING" ;
     push @targets, $p if (($v_repo ne $V_INST{$p}) and ($v_repo ne "MISSING"));
   }