diff --git a/playbooks/dnf-automatic.yml b/playbooks/dnf-automatic.yml
new file mode 100644
index 0000000..ef8e79a
--- /dev/null
+++ b/playbooks/dnf-automatic.yml
@@ -0,0 +1,30 @@
+- name: install and configure automatic security updates
+  hosts: alma
+  become: true
+
+  tasks:
+    - name: install dnf-automatic
+      dnf:
+        name:
+          - dnf-automatic
+        state: present
+
+    - name: edit update type to security only
+      ansible.builtin.ini_file:
+        path: /etc/dnf/automatic.conf
+        section: commands
+        option: upgrade_type
+        value: security
+
+    - name: allow automatic installation of updates
+      ansible.builtin.ini_file:
+        path: /etc/dnf/automatic.conf
+        section: commands
+        option: apply_updates
+        value: "yes"
+
+    - name: start and enable dnf-automatic install timer
+      ansible.builtin.systemd:
+        name: dnf-automatic-install.timer
+        enabled: true
+        state: started