For me, unattended-upgrade does it's thing. Updating other packages happens whenever I think about it. Very few things are not containerized and there's very little added beyond the base Debian install, so when I do update its maybe a dozen packages.

I would previously reboot during thunderstorms if we lost power, but now that I've got a UPS I probably ought to come up with a different plan.