No. Ubuntu's documentation says unattended-upgrades considers only origins listed in Allowed-Origins, and that just adding another package repository will not make the tool use it. A PPA or vendor repository must be added by its Origin value, otherwise its packages sit unpatched while the system looks up to date.
Why this catches teams out
A developer adds a repository to get a newer database client, a language runtime or a vendor agent. Installation works. Months later, the distribution packages update nightly, but the packages from that extra repository never do. The host looks maintained because security updates are enabled, and nobody notices the gap.
Ubuntu applies security updates through unattended-upgrades, which is installed by default and runs the equivalent of apt update and apt upgrade once per day. Its settings live in /etc/apt/apt.conf.d/50unattended-upgrades. The key setting is the list of allowed origins.
How to see what is and is not covered
- List which repositories are configured, and which packages came from them:
apt-cache policy package-name
grep -r "" /etc/apt/sources.list.d/
- Open the unattended upgrades config and read the allowed origins block.
- Run a dry run and read the debug output, as described in how to preview security updates before you install them:
sudo unattended-upgrade --dry-run -d
- Compare what apt says is upgradable with what the dry run would install. Packages in the first list but not the second are outside the automatic job.
Your options for each extra repository
| Option | When it fits | Watch out for |
|---|---|---|
| Add the origin to Allowed-Origins | You trust the publisher and want unattended fixes | Third party updates may be less tested. A bad update will install without review |
| Leave it out and patch by hand | The package is critical and needs a change window | You must track it yourself, so put it in your inventory |
| Replace it with a distribution package | A supported version is good enough | May be an older version |
| Remove the repository | Nobody needs it anymore | Check what depends on its packages |
Ubuntu's documentation also notes that a PPA must be matched by its Origin value, not just added to sources. And it warns that blocking packages with the Package-Blacklist list, which takes Python regular expressions, can stop other updates that depend on the blocked package.
Trust the source too
An unattended job installs whatever the publisher ships, as root, at night. That makes a third party repository a supply chain input. Use the signed by method to bind each repository to its own key, as explained in signed apt repository: signed-by instead of apt-key, and keep a list of who owns each repository.
Reboots and restarts still apply
Even when the origin is allowed, a patched library does not help until the process restarts. Ubuntu's documentation describes the automatic reboot setting, which is false by default, and needrestart, which since 24.04 restarts affected services automatically by default. See Ubuntu unattended upgrades: enable and reboot settings.
Quick check
I added a PPA. Will its packages update automatically?
Not unless its Origin is listed in Allowed-Origins, according to Ubuntu's documentation.
How can I find packages the automatic job skips?
Compare the list of upgradable packages with the output of a dry run of unattended-upgrade. Anything missing from the dry run is outside the job.
Safeguard's SBOM and dependency scanning lists the packages on a host or image, including those from added repositories, and matches them to known advisories. Try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
