diff --git a/profile/manifests/apt.pp b/profile/manifests/apt.pp
index dc1fe1fcddd7378f5be706719c3fdaee36b2aed6..f69b8e5cbf121e884bbdc9e001faac9efe6bdb68 100644
--- a/profile/manifests/apt.pp
+++ b/profile/manifests/apt.pp
@@ -1,8 +1,6 @@
 # APT profile
 class profile::apt (
   Boolean $auto_reboot                = true,
-  Optional[Boolean] $legacy_origin    = $unattended_upgrades::params::legacy_origin,
-  Optional[Array[String[1]]] $origins = $unattended_upgrades::params::origins,
 ) {
 
   include apt
@@ -13,21 +11,8 @@ class profile::apt (
     content  => "Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;\n",
   })
 
-  # workaround for Docker, which can't infer the following from `lsbdistid`
-  # fact.
-  $real_legacy_origin = $legacy_origin ? { undef => false, default => $legacy_origin }
-  $real_origins = $origins ? {
-    undef => [
-      'origin=Debian,codename=buster,label=Debian',
-      'origin=Debian,codename=buster,label=Debian-Security',
-    ],
-    default => $origins
-  }
-
-  class { 'unattended_upgrades':
-    auto          => { 'reboot' => $auto_reboot },
-    legacy_origin => $real_legacy_origin,
-    origins       => $real_origins,
+  class { 'profile::apt::unattended_upgrades':
+    auto_reboot => $auto_reboot,
   }
 
 }
diff --git a/profile/manifests/apt/unattended_upgrades.pp b/profile/manifests/apt/unattended_upgrades.pp
new file mode 100644
index 0000000000000000000000000000000000000000..1afdd35b4e9c853eeadf323fefba5a864e345a5f
--- /dev/null
+++ b/profile/manifests/apt/unattended_upgrades.pp
@@ -0,0 +1,23 @@
+# APT unattended_upgrades profile
+class profile::apt::unattended_upgrades (
+  Boolean $auto_reboot = true,
+) inherits unattended_upgrades::params {
+
+  # workaround for Docker, which can't infer the following from `lsbdistid`
+  # fact.
+  $real_legacy_origin = $legacy_origin ? { undef => false, default => $legacy_origin }
+  $real_origins = $origins ? {
+    undef => [
+      'origin=Debian,codename=buster,label=Debian',
+      'origin=Debian,codename=buster,label=Debian-Security',
+    ],
+    default => $origins
+  }
+
+  class { 'unattended_upgrades':
+    auto          => { 'reboot' => $auto_reboot },
+    legacy_origin => $real_legacy_origin,
+    origins       => $real_origins,
+  }
+
+}