diff --git a/charts/kubean/templates/prehook-job.yml b/charts/kubean/templates/prehook-job.yml
index 7bfce41d4..6bbef857e 100644
--- a/charts/kubean/templates/prehook-job.yml
+++ b/charts/kubean/templates/prehook-job.yml
@@ -54,6 +54,70 @@ spec:
           configMap:
             name: {{ $name }}-pre-manifests
 ---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ $name }}-pre-hook-add-manifest-annotation"
+  namespace: {{ $namespace }}
+  annotations:
+    # only for pre-upgrade and do not need this for pre-install
+    "helm.sh/hook": pre-upgrade
+    "helm.sh/hook-weight": "4"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      name: {{ $name }}
+      labels:
+        app.kubernetes.io/instance: {{ $name | quote }}
+    spec:
+      serviceAccountName: {{ $name }}-pre-hook-job
+      restartPolicy: Never
+      containers:
+        - name: keep-manifest
+          image: {{ include "kubean.prehookImage" . }}
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -c
+            - |
+              bash <<'EOF'
+              set -ex
+              kubectl annotate deployment.apps --all helm.sh/resource-policy=keep
+              EOF
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "{{ $name }}-pre-hook-remove-manifest-annotation"
+  namespace: {{ $namespace }}
+  annotations:
+    # remove annotation so that manifest could be deleted by helm when uninstall kubean
+    "helm.sh/hook": pre-delete
+    "helm.sh/hook-weight": "4"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+spec:
+  template:
+    metadata:
+      name: {{ $name }}
+      labels:
+        app.kubernetes.io/instance: {{ $name | quote }}
+    spec:
+      serviceAccountName: {{ $name }}-pre-hook-job
+      restartPolicy: Never
+      containers:
+        - name: remove-manifest-annotation
+          image: {{ include "kubean.prehookImage" . }}
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -c
+            - |
+              bash <<'EOF'
+              set -ex
+              kubectl annotate manifest --all helm.sh/resource-policy-
+              EOF
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata: