diff --git a/CLAUDE.md b/CLAUDE.md
index 23be735..96bd452 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -74,7 +74,7 @@ subdomain.
 
 ### Roles (`site.yml` runs common, docker, cron)
 - **bootstrap**: user, SSH key, passwordless sudo, UFW, then `artis3n.tailscale`.
-- **common**: `aptitude`, `jq`, UFW on with default deny.
+- **common**: `aptitude`, `jq`, daily unattended security updates, UFW on with default deny.
 - **docker**: Docker CE, shell setup (zsh, Atuin, bat), ufw-docker, the `lava`
   network, and every service.
 - **cron**: dockcheck (08:00, auto-updates labelled containers, Gotify notices)
diff --git a/roles/common/README.md b/roles/common/README.md
index bf1a2da..5c5b75a 100644
--- a/roles/common/README.md
+++ b/roles/common/README.md
@@ -4,6 +4,8 @@ Base setup applied first by `site.yml` (tag `common`).
 
 ## What it does
 - Installs `aptitude` and `jq`.
+- Installs `unattended-upgrades` and turns on daily security updates
+  (Debian security archive only, no automatic reboots).
 - Makes sure UFW is enabled with default deny. The SSH rule comes from the
   bootstrap role, and container rules from `ufw-docker` in the docker role.
 
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index 1992917..257e0ac 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -9,4 +9,19 @@
 - name: UFW - Enable and deny by default
   community.general.ufw:
     state: enabled
-    default: deny
\ No newline at end of file
+    default: deny
+# Security updates install themselves each day (Debian's default origins:
+# the -security archive only). No automatic reboots.
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+
+- name: Turn on daily unattended upgrades
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    mode: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
diff --git a/roles/docker/templates/hoarder-env.j2 b/roles/docker/templates/hoarder-env.j2
index 1d3933b..eda6c1f 100644
--- a/roles/docker/templates/hoarder-env.j2
+++ b/roles/docker/templates/hoarder-env.j2
@@ -7,4 +7,6 @@ OAUTH_CLIENT_SECRET={{ vault_hoarder.pocketid.client_secret }}
 OAUTH_CLIENT_ID={{ vault_hoarder.pocketid.client_id }}
 OAUTH_PROVIDER_NAME=Pocket ID
 OAUTH_WELLKNOWN_URL=https://{{ subdomains.pocketid }}/.well-known/openid-configuration
-OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=false
\ No newline at end of file
+OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=false
+# Karakeep allows open signups unless this is set. Unset it briefly to add a user.
+DISABLE_SIGNUPS=true
\ No newline at end of file