Manually patching a server on a schedule is how security updates get delayed indefinitely — automating at least security-critical patches closes that gap without requiring daily manual attention.
sudo apt install unattended-upgrades sudo dpkg-reconfigure --priority=low unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
"${distro_id}:${distro_codename}-security";
};
// Automatically reboot if a kernel update requires it, at a specific time
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";
Security-Only, Not Everything
The config above scopes automatic updates to security patches specifically, not general feature updates — this is a deliberate, sensible default: security patches are low-risk to apply blind, while general package updates occasionally introduce breaking changes better reviewed before applying, especially on a production server.
Automatic reboots for kernel updates are worth scheduling during a genuine low-traffic window, and pairing with a monitoring alert so you know when one occurred rather than discovering it accidentally.