1. the dsa-update-apt-status needs a TERM variable otherwise it
 sleeps for a long time

 2. we can use unattended-upgrade to DTRT most of the time

howto/upgrades.md

@@ -59,7 +59,15 @@ discussion and rationale of that change.
 It's also possible to do a manual mass-upgrade run with
 [Cumin](howto/cumin):
 
-    cumin -b 10  '*' 'apt update ; apt upgrade -yy ; dsa-update-apt-status'
+    cumin -b 10  '*' 'apt update ; unattended-upgrde ; TERM=doit dsa-update-apt-status'
+
+The `TERM` override is to skip the jitter introduced by the script
+when running automated.
+
+The above will respect the `unattended-upgrade` policy, which may
+block certain upgrades. If you want to bypass that, use regular `apt`:
+
+    cumin -b 10  '*' 'apt update ; apt upgrade -yy ; TERM=doit dsa-update-apt-status'
 
 ### Restarting services by hand