diff --git a/install_orbit_environment.sh b/install_orbit_environment.sh
index 55d571a..ed38f3b 100644
--- a/install_orbit_environment.sh
+++ b/install_orbit_environment.sh
@@ -5,6 +5,17 @@ if [[ -e "/etc/needrestart/needrestart.conf" ]]; then
     sudo sed -E -i "s/(^|#)\\\$nrconf\{restart\}\s*=.*/\$nrconf\{restart\} = 'a';/g" /etc/needrestart/needrestart.conf
     sudo sed -E -i "s/(^|#)\\\$nrconf\{kernelhints\}\s*=.*/\$nrconf\{kernelhints\} = -1;/g" /etc/needrestart/needrestart.conf
 fi
+# 關閉系統自動更新（unattended-upgrades），避免正式站在無人監控時
+# 被自動升級到跟 Ruby/OpenSSL/nginx 環境不相容的套件版本
+if [[ -e "/etc/apt/apt.conf.d/20auto-upgrades" ]]; then
+	sudo sed -i 's/APT::Periodic::Update-Package-Lists "1"/APT::Periodic::Update-Package-Lists "0"/' /etc/apt/apt.conf.d/20auto-upgrades
+	sudo sed -i 's/APT::Periodic::Unattended-Upgrade "1"/APT::Periodic::Unattended-Upgrade "0"/' /etc/apt/apt.conf.d/20auto-upgrades
+fi
+if systemctl list-unit-files | grep -q '^unattended-upgrades.service'; then
+	sudo systemctl stop unattended-upgrades.service 2>/dev/null || true
+	sudo systemctl disable unattended-upgrades.service 2>/dev/null || true
+fi
+
 sudo apt update
 sudo apt install -y git psmisc #fuser
 org_pwd=$(pwd)