Very good read, subscribed to see what happens.

Don’t learn out of work, learn in work. But… I’m retired now, got out just in time.

Unless you want to use Matter which (from my glancing at the docs) requires IPv6?

As others have said, if your VMs are Linux, set up unattended_updates and forget about it.

If your VMs are windows, then Action1 is free up to 200 clients, it does need an agent installed, but that auto updates too.