diff --git a/crowdsec/templates/crowdsec-hubupdate.sh.j2 b/crowdsec/templates/crowdsec-hubupdate.sh.j2
index c8ab4e8..c503afa 100644
--- a/crowdsec/templates/crowdsec-hubupdate.sh.j2
+++ b/crowdsec/templates/crowdsec-hubupdate.sh.j2
@@ -4,7 +4,8 @@
 # "cscli scenarios remove --force" taints the collection that holds the scenario, and a plain "cscli hub upgrade" skips tainted
 # collections for good. The upgrade therefore runs with --force, which also brings the removed scenarios back, and the removal is
 # applied again. crowdsec is reloaded only when the installed hub files or the data files differ afterwards; with NO_RELOAD=1
-# the script prints "changed" instead, for the role, which restarts crowdsec once at the end of its run.
+# the script prints "changed" instead, for the role, which restarts crowdsec once at the end of its run. A failed step does not skip
+# the later ones, so the removal of the disabled scenarios always runs; the script then exits non-zero.
 set -eu
 
 test -x /usr/bin/cscli || exit 0
@@ -18,13 +19,23 @@ fingerprint() {
 
 before="$(fingerprint)"
 
-/usr/bin/cscli --error hub update >/dev/null
-/usr/bin/cscli --error hub upgrade --force >/dev/null
+failed=0
+
+# A failed list command does not skip the removal: the scenario is then removed without knowing whether it is installed.
+remove_scenario() {
+  if list="$(/usr/bin/cscli scenarios list -o raw)"; then
+    printf '%s\n' "$list" | cut -d, -f1 | grep -qxF "$1" || return 0
+  else
+    failed=1
+  fi
+  /usr/bin/cscli --error scenarios remove "$1" --force >/dev/null || failed=1
+}
+
+/usr/bin/cscli --error hub update >/dev/null || failed=1
+/usr/bin/cscli --error hub upgrade --force >/dev/null || failed=1
 
 {% for scenario in crowdsec.disabled_scenarios.values() | reject('none') | unique | sort %}
-if /usr/bin/cscli scenarios list -o raw | cut -d, -f1 | grep -qxF '{{ scenario }}'; then
-  /usr/bin/cscli --error scenarios remove '{{ scenario }}' --force >/dev/null
-fi
+remove_scenario '{{ scenario }}'
 {% endfor %}
 
 if [ "$before" != "$(fingerprint)" ]; then
@@ -34,3 +45,5 @@ if [ "$before" != "$(fingerprint)" ]; then
     systemctl reload crowdsec.service
   fi
 fi
+
+exit "$failed"