diff --git a/linux/kubuntu/setup-unattended-upgrades.sh b/linux/kubuntu/setup-unattended-upgrades.sh
index ffb3ed2..6f4271f 100644
--- a/linux/kubuntu/setup-unattended-upgrades.sh
+++ b/linux/kubuntu/setup-unattended-upgrades.sh
@@ -18,16 +18,23 @@ echo "[2/5] unattended-upgrades installieren..."
 apt install -y unattended-upgrades
 
 echo "[3/5] Konfiguration anpassen..."
+CONF=/etc/apt/apt.conf.d/50unattended-upgrades
+
 # Backup erstellen
-cp /etc/apt/apt.conf.d/50unattended-upgrades /etc/apt/apt.conf.d/50unattended-upgrades.bak.$(date +%Y%m%d)
+cp "$CONF" "${CONF}.bak.$(date +%Y%m%d)"
 
 # Security-Updates aktivieren
-sed -i 's|//\("${distro_id}:${distro_codename}-security";\)|\1|' /etc/apt/apt.conf.d/50unattended-upgrades
-sed -i 's|//\("${distro_id}ESMApps:${distro_codename}-apps-security";\)|\1|' /etc/apt/apt.conf.d/50unattended-upgrades
-sed -i 's|//\("${distro_id}ESM:${distro_codename}-infra-security";\)|\1|' /etc/apt/apt.conf.d/50unattended-upgrades
+# Die ${distro_id}-Variablen werden von unattended-upgrades selbst aufgelöst.
+# shellcheck disable=SC2016
+sed -i 's|//[[:space:]]*\("\${distro_id}:\${distro_codename}-security";")|\1|' "$CONF"
+# shellcheck disable=SC2016
+sed -i 's|//[[:space:]]*\("\${distro_id}ESMApps:\${distro_codename}-apps-security";")|\1|' "$CONF"
+# shellcheck disable=SC2016
+sed -i 's|//[[:space:]]*\("\${distro_id}ESM:\${distro_codename}-infra-security";")|\1|' "$CONF"
 
 # Optionale: Alle Updates aktivieren (Security + Updates)
-# sed -i 's|//\("${distro_id}:${distro_codename}-updates";\)|\1|' /etc/apt/apt.conf.d/50unattended-upgrades
+# shellcheck disable=SC2016
+# sed -i 's|//[[:space:]]*\("\${distro_id}:\${distro_codename}-updates";")|\1|' "$CONF"
 
 echo "[4/5] GUI-Notifier deaktivieren..."
 if dpkg -l | grep -q plasma-discover-notifier; then
@@ -48,4 +55,4 @@ echo "Status prüfen mit: sudo systemctl status unattended-upgrades"
 echo "Testlauf mit: sudo unattended-upgrade --dry-run"
 echo "Logs unter: /var/log/unattended-upgrades/"
 echo ""
-echo "Konfiguration gesichert unter: /etc/apt/apt.conf.d/50unattended-upgrades.bak.$(date +%Y%m%d)"
+echo "Konfiguration gesichert unter: ${CONF}.bak.$(date +%Y%m%d)"