diff --git a/parts/k8s/cloud-init/artifacts/cse_helpers.sh b/parts/k8s/cloud-init/artifacts/cse_helpers.sh
index b833b90b49..45b26154a3 100755
--- a/parts/k8s/cloud-init/artifacts/cse_helpers.sh
+++ b/parts/k8s/cloud-init/artifacts/cse_helpers.sh
@@ -225,6 +225,22 @@ apt_get_dist_upgrade() {
   echo Executed apt-get dist-upgrade $i times
   wait_for_apt_locks
 }
+apt_fix_keys() {
+  retries=10
+  output=/tmp/apt-fix-keys.out
+  for i in $(seq 1 $retries); do
+    wait_for_apt_locks
+    ! (apt-get update | tee $output | grep NO_PUBKEY) && \
+    cat $output && break || \
+    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $(apt-get update | grep NO_PUBKEY -m 1 | awk -F "NO_PUBKEY" '{print $2}')
+    if [ $i -eq $retries ]; then
+      echo Detected NO_PUBKEY but unable to fix after $i retries
+      return 1
+    else sleep 1
+    fi
+  done
+  echo Executed apt-get update NO_PUBKEY fix $i times
+}
 systemctl_restart() {
     retries=$1; wait_sleep=$2; timeout=$3 svcname=$4
     for i in $(seq 1 $retries); do
diff --git a/parts/k8s/cloud-init/artifacts/cse_main.sh b/parts/k8s/cloud-init/artifacts/cse_main.sh
index 9208d1d577..38a6444a2f 100755
--- a/parts/k8s/cloud-init/artifacts/cse_main.sh
+++ b/parts/k8s/cloud-init/artifacts/cse_main.sh
@@ -57,6 +57,8 @@ if [[ "${GPU_NODE}" != "true" ]]; then
   cleanUpGPUDrivers
 fi
 
+apt_fix_keys &
+
 VHD_LOGS_FILEPATH=/opt/azure/vhd-install.complete
 if [[ "${IS_VHD}" = true ]]; then
     if [ ! -f $VHD_LOGS_FILEPATH ]; then
diff --git a/pkg/engine/templates_generated.go b/pkg/engine/templates_generated.go
index af4cd9052b..51291ad9f0 100644
--- a/pkg/engine/templates_generated.go
+++ b/pkg/engine/templates_generated.go
@@ -13289,6 +13289,22 @@ apt_get_dist_upgrade() {
   echo Executed apt-get dist-upgrade $i times
   wait_for_apt_locks
 }
+apt_fix_keys() {
+  retries=10
+  output=/tmp/apt-fix-keys.out
+  for i in $(seq 1 $retries); do
+    wait_for_apt_locks
+    ! (apt-get update | tee $output | grep NO_PUBKEY) && \
+    cat $output && break || \
+    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $(apt-get update | grep NO_PUBKEY -m 1 | awk -F "NO_PUBKEY" '{print $2}')
+    if [ $i -eq $retries ]; then
+      echo Detected NO_PUBKEY but unable to fix after $i retries
+      return 1
+    else sleep 1
+    fi
+  done
+  echo Executed apt-get update NO_PUBKEY fix $i times
+}
 systemctl_restart() {
     retries=$1; wait_sleep=$2; timeout=$3 svcname=$4
     for i in $(seq 1 $retries); do
@@ -13720,6 +13736,8 @@ if [[ "${GPU_NODE}" != "true" ]]; then
   cleanUpGPUDrivers
 fi
 
+apt_fix_keys &
+
 VHD_LOGS_FILEPATH=/opt/azure/vhd-install.complete
 if [[ "${IS_VHD}" = true ]]; then
     if [ ! -f $VHD_LOGS_FILEPATH ]; then