diff --git a/src/debian/debian_ts_20auto_upgrades.conf b/src/debian/debian_ts_20auto_upgrades.conf
index 0336ec6..1d82c04 100644
--- a/src/debian/debian_ts_20auto_upgrades.conf
+++ b/src/debian/debian_ts_20auto_upgrades.conf
@@ -1,5 +1,5 @@
 APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Unattended-Upgrade "10";
+APT::Periodic::Unattended-Upgrade "7";
 APT::Periodic::AutocleanInterval "1";
 APT::Periodic::CleanInterval "1";
 
diff --git a/src/debian/debian_ts_nftables.conf b/src/debian/debian_ts_nftables.conf
index 44085fe..41b88bb 100644
--- a/src/debian/debian_ts_nftables.conf
+++ b/src/debian/debian_ts_nftables.conf
@@ -83,7 +83,8 @@ table inet router {
     }
 
     chain accept_to_lan {
-        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NAT leakage"
+        meta nfproto ipv4 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NATv4 leakage"
+        meta nfproto ipv6 oifname "eth0" ct state invalid counter drop comment "defconf: prevent NATv6 leakage"
         oifname "eth0" counter accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
     }
 
@@ -130,6 +131,7 @@ table inet router {
 
     chain srcnat_lan {
         meta nfproto ipv4 counter masquerade comment "defconf: masquerade IPv4 LAN traffic"
+        meta nfproto ipv6 counter masquerade comment "defconf: masquerade IPv6 LAN traffic"
     }