diff --git a/data/common/common.yaml b/data/common/common.yaml
--- a/data/common/common.yaml
+++ b/data/common/common.yaml
@@ -1360,13 +1360,13 @@
 
 swh::apt_config::unattended_upgrades: true
 swh::apt_config::unattended_upgrades::origins:
- - "o=Debian,n=%{::lsbdistcodename}"                                    # main Debian archive
- - "o=Debian,n=%{::lsbdistcodename}-updates"                            # stable-updates (ex-volatile)
- - "o=Debian,n=%{::lsbdistcodename},l=Debian-Security"                  # security updates
- - "o=debian icinga-%{::lsbdistcodename},n=icinga-%{::lsbdistcodename}" # Icinga2 repository
- - "o=Debian Azure,n=%{::lsbdistcodename}"                              # Debian Azure
- - "o=Proxmox,n=%{::lsbdistcodename}"                                   # Proxmox repository
- - "o=packages.sury.org"                                                # PHP backports (tate)
+ - "o=Debian,codename=${distro_codename}"                      # main Debian archive
+ - "o=Debian,codename=${distro_codename}-updates"              # stable-updates (ex-volatile)
+ - "o=Debian,codename=${distro_codename},l=Debian-Security"    # security updates
+ - "o=debian icinga-stable,codename=icinga-${distro_codename}" # Icinga2 repository
+ - "o=Debian Azure,codename=${distro_codename}"                # Debian Azure
+ - "o=Proxmox,codename=${distro_codename}"                     # Proxmox repository
+ - "o=packages.sury.org"                                       # PHP backports (tate)