Automatic Updates

Ben Cotton, Petr Bokoc, Jean-Baptiste Holcroft, Rowan Puttergill Version F41 and newer Last review: 2026-05-10
Fedora can automatically download and install updates using dnf-automatic. This page covers how to decide whether automatic updates are right for your system, how to set them up, and how to adjust their behaviour.

Deciding whether to use automatic updates

There is no single answer to the question of whether to use automatic updates, as this depends on the system and your requirements. A useful general rule:

If the system is a critical server that cannot tolerate unplanned downtime, do not use automatic updates. Otherwise, you can use them.

That said, keeping a system up-to-date is an important part of security, and automatic updates can help ensure that you do not miss important updates. If you decide not to use automatic updates, make sure to apply updates manually on a regular basis or consider setting up a test and integration environment to validate updates before applying them to production systems. You can also use repository mirroring to test updates on a non-critical system before applying them to production.

Reasons to use automatic updates

  • You are unlikely to apply updates manually on a regular basis.

  • The system is not critical and occasional unplanned downtime is acceptable.

  • You can access the system physically if an update causes problems.

  • You have proper backups of any important data on the system.

Reasons to avoid automatic updates

  • The system provides a critical service where unscheduled downtime is not acceptable.

  • You use custom, compiled, or third-party software with strict package version requirements.

  • You use a custom kernel or third-party kernel modules. You can mitigate this by excluding kernel updates, which is the default in Fedora’s dnf.conf.

  • Your environment requires formal change-control procedures.

  • You use third-party DNF repositories that might conflict with Fedora’s versioning.

  • Updates to packages such as OpenSSL or database servers can have unexpected effects on dependent services.

  • A kernel update does not take effect until the system reboots, and service updates might require a restart. Updating a system and not rebooting can create a window where the system appears updated but the fix is not yet active.

Setting up dnf-automatic

dnf-automatic is not installed by default. Install it with:

$ sudo dnf install dnf-automatic

Configuring automatic.conf

dnf-automatic reads its configuration from /etc/dnf/automatic.conf. By default it downloads updates but does not install them. Open the file to adjust this:

$ sudo nano /etc/dnf/automatic.conf

To download, install, and reboot when needed:

[commands]
apply_updates=True
reboot=when-needed

Omit reboot=when-needed to leave rebooting to you. See the dnf-automatic documentation for the full list of options.

Enabling the timer

Once configured, enable and start the systemd timer:

$ sudo systemctl enable --now dnf-automatic.timer

Check that it is running:

$ systemctl status dnf-automatic.timer
Fedora signs packages with GPG (GNU Privacy Guard) keys and enables gpgcheck by default in /etc/dnf/dnf.conf, so DNF verifies each automatically installed update before installation. Update quality is a separate concern. Each package goes through a QA process, but it is always possible that an update causes problems. Monitoring your system after updates is good practice regardless.

Monitoring updates

Check what dnf-automatic has installed by monitoring its log file /var/log/dnf5.log.

To receive email notifications after each run, add the following to /etc/dnf/automatic.conf:

[emitters]
emit_via = email

[email]
# The address to send email messages from.
email_from = root@localhost.com

# List of addresses to send messages to.
email_to = root

# Name of the host to connect to to send email messages.
email_host = localhost

Replace root with the address you want reports sent to, and localhost with your SMTP server address.

Adjusting update behaviour

Download-only or notify-only mode

If you would rather review updates before installing them, set apply_updates=False in /etc/dnf/automatic.conf. dnf-automatic will then download updates without applying them, and can notify you by email. The options in automatic.conf control the full range of behaviour, including notify-only without downloading. See the dnf-automatic options reference for details.

Scheduling

By default, dnf-automatic.timer runs once daily. To change when it runs, change the timer by using the instructions on the Understanding and administering systemd page.

Other protection while updates are pending

If you pause or delay automatic updates, consider additional precautions: a host-based firewall by using firewalld, monitoring system logs for intrusions, and restarting services that require it after updates are applied.

Alternative tools

auter is an alternative to dnf-automatic that offers more flexibility in scheduling and supports running custom scripts before and after updates, including automatic reboots.

$ sudo dnf install auter

Edit /etc/auter/auter.conf to configure it. auter is not scheduled by default. Add a schedule for --prep (pre-download) and --apply (install updates) using the examples in /etc/cron.d/auter.

To run auter immediately for testing:

$ auter --apply

To disable auter from running, including from any cron job:

$ auter --disable

Want to help? Learn how to contribute to Fedora Docs ›