diff --git a/roles/monitoring/tasks/promtail.yml b/roles/monitoring/tasks/promtail.yml
index b9af27e..32142e0 100644
--- a/roles/monitoring/tasks/promtail.yml
+++ b/roles/monitoring/tasks/promtail.yml
@@ -13,6 +13,11 @@
     repo: "deb [signed-by=/etc/apt/keyrings/grafana.gpg] https://apt.grafana.com stable main"
     filename: "grafana"
 
+- name: allow unattended upgrades from the grafana repo
+  template:
+    src: unattended-upgrades-promtail
+    dest: /etc/apt/apt.conf.d/unattended-upgrades-promtail
+
 - name: install promtail
   apt:
     name: promtail
diff --git a/roles/monitoring/templates/unattended-upgrades-promtail b/roles/monitoring/templates/unattended-upgrades-promtail
new file mode 100644
index 0000000..2b07075
--- /dev/null
+++ b/roles/monitoring/templates/unattended-upgrades-promtail
@@ -0,0 +1,3 @@
+Unattended-Upgrade::Origins-Pattern {
+        "site=apt.grafana.com"
+}