diff --git a/linux/kubuntu/setup-unattended-upgrades-full.sh b/linux/kubuntu/setup-unattended-upgrades-full.sh
index 17100ed..7d4741d 100644
--- a/linux/kubuntu/setup-unattended-upgrades-full.sh
+++ b/linux/kubuntu/setup-unattended-upgrades-full.sh
@@ -24,23 +24,22 @@ CONF=/etc/apt/apt.conf.d/50unattended-upgrades
 cp "$CONF" "${CONF}.bak.$(date +%Y%m%d)"
 
 # Security-Updates aktivieren (flexibles sed mit optionalem Whitespace)
-for pattern in \
-    '"${distro_id}:${distro_codename}-security";' \
-    '"${distro_id}ESMApps:${distro_codename}-apps-security";' \
-    '"${distro_id}ESM:${distro_codename}-infra-security";' \
-    '"${distro_id}:${distro_codename}-updates";'; do
-    sed -i "s|//[[:space:]]*\\(${pattern}\\)|\\1|" "$CONF"
-done
+# Hinweis: Die ${distro_id}-Variablen werden von unattended-upgrades selbst aufgelöst,
+# daher müssen sie im sed-Pattern als Literal-Strings stehen (escaped mit backslash)
+sed -i 's|//[[:space:]]*\("\${distro_id}:\${distro_codename}-security";")|\1|' "$CONF"
+sed -i 's|//[[:space:]]*\("\${distro_id}ESMApps:\${distro_codename}-apps-security";")|\1|' "$CONF"
+sed -i 's|//[[:space:]]*\("\${distro_id}ESM:\${distro_codename}-infra-security";")|\1|' "$CONF"
+sed -i 's|//[[:space:]]*\("\${distro_id}:\${distro_codename}-updates";")|\1|' "$CONF"
 
 echo "[4/7] 20auto-upgrades setzen..."
-cat > /etc/apt/apt.conf.d/20auto-upgrades <> 'AUTOEOF'
+cat > /etc/apt/apt.conf.d/20auto-upgrades << 'AUTOEOF'
 APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Unattended-Upgrade "1";
 AUTOEOF
 
 echo "[5/7] GUI-Notifier deaktivieren (sanft)..."
 mkdir -p /etc/xdg/autostart
-cat > /etc/xdg/autostart/org.kde.discover.notifier.desktop <> 'DESKEOF'
+cat > /etc/xdg/autostart/org.kde.discover.notifier.desktop << 'DESKEOF'
 [Desktop Entry]
 Hidden=true
 DESKEOF
@@ -63,4 +62,3 @@ echo "Testlauf mit: sudo unattended-upgrade --dry-run"
 echo "Logs unter: /var/log/unattended-upgrades/"
 echo ""
 echo "Konfiguration gesichert unter: ${CONF}.bak.$(date +%Y%m%d)"
-