unattended-upgrades: everything except new major versions

I want unattended-upgrades to upgrade everything automatically on my Debian bullyseye system, except for new major version (i.e. not bookworm, when it's released). I couldn't find anything describing this scenario, and I had a couple of ideas of how to do this: Unattended-Upgrade::Origins-Pattern { "origin=*"; } Unattended-Upgrade::Package-Blacklist { "origin=Debian,codename=^((?!bullseye).)*"; }; Or this: Unattended-Upgrade::Origins-Pattern { "origin=*"; } Unattended-Upgrade::Package-Blacklist { "origin=Debian,codename=bookworm"; }; Can anyone give me some guidance on whether either of these would work, or whether there's a better strategy?