diff --git a/linux/kubuntu/setup-unattended-upgrades.sh b/linux/kubuntu/setup-unattended-upgrades.sh
index 6f4271f..188da27 100644
--- a/linux/kubuntu/setup-unattended-upgrades.sh
+++ b/linux/kubuntu/setup-unattended-upgrades.sh
@@ -24,17 +24,14 @@ CONF=/etc/apt/apt.conf.d/50unattended-upgrades
 cp "$CONF" "${CONF}.bak.$(date +%Y%m%d)"
 
 # Security-Updates aktivieren
-# Die ${distro_id}-Variablen werden von unattended-upgrades selbst aufgelöst.
-# shellcheck disable=SC2016
-sed -i 's|//[[:space:]]*\("\${distro_id}:\${distro_codename}-security";")|\1|' "$CONF"
-# shellcheck disable=SC2016
-sed -i 's|//[[:space:]]*\("\${distro_id}ESMApps:\${distro_codename}-apps-security";")|\1|' "$CONF"
-# shellcheck disable=SC2016
-sed -i 's|//[[:space:]]*\("\${distro_id}ESM:\${distro_codename}-infra-security";")|\1|' "$CONF"
+# Die ${distro_id}-Variablen werden von unattended-upgrades selbst aufgelöst,
+# daher müssen sie im sed-Pattern als Literal-Strings stehen.
+sed -i 's|//[[:space:]]*"\${distro_id}:\${distro_codename}-security";|"\${distro_id}:\${distro_codename}-security";|' "$CONF"
+sed -i 's|//[[:space:]]*"\${distro_id}ESMApps:\${distro_codename}-apps-security";|"\${distro_id}ESMApps:\${distro_codename}-apps-security";|' "$CONF"
+sed -i 's|//[[:space:]]*"\${distro_id}ESM:\${distro_codename}-infra-security";|"\${distro_id}ESM:\${distro_codename}-infra-security";|' "$CONF"
 
 # Optionale: Alle Updates aktivieren (Security + Updates)
-# shellcheck disable=SC2016
-# sed -i 's|//[[:space:]]*\("\${distro_id}:\${distro_codename}-updates";")|\1|' "$CONF"
+# sed -i 's|//[[:space:]]*"\${distro_id}:\${distro_codename}-updates";|"\${distro_id}:\${distro_codename}-updates";|' "$CONF"
 
 echo "[4/5] GUI-Notifier deaktivieren..."
 if dpkg -l | grep -q plasma-discover-notifier; then