diff --git a/services/focalboard.nix b/services/focalboard.nix
index 4d5599d..d161178 100644
--- a/services/focalboard.nix
+++ b/services/focalboard.nix
@@ -58,7 +58,8 @@ in {
     };
     # only secrets need to be included, e.g. FOCALBOARD_DBCONFIG
     environmentFiles = [ config.age.secrets.focalboard-env.path ];
-    extraOptions = [ "--network=host" ];
+    extraOptions =
+      [ "--network=host" "--label=io.containers.autoupdate=registry" ];
   };
 
   systemd.services."${ociBackend}-focalboard" = {
diff --git a/services/immich.nix b/services/immich.nix
index efddc55..28e3722 100644
--- a/services/immich.nix
+++ b/services/immich.nix
@@ -35,6 +35,7 @@ let
       "--add-host=immich-machine-learning:127.0.0.1"
       "--add-host=immich-web:127.0.0.1"
       "--add-host=typesense:127.0.0.1"
+      "--label=io.containers.autoupdate=registry"
     ];
   };
 in {
@@ -118,7 +119,8 @@ in {
       environment.TYPESENSE_DATA_DIR = "/data";
       environmentFiles = [ config.age.secrets.immich-typesense-env.path ];
       volumes = [ "${typesenseDataDir}:/data" ];
-      extraOptions = [ "--network=host" ];
+      extraOptions =
+        [ "--network=host" "--label=io.containers.autoupdate=registry" ];
     };
   };
 
diff --git a/services/nextcloud.nix b/services/nextcloud.nix
index d43cc81..f62849b 100644
--- a/services/nextcloud.nix
+++ b/services/nextcloud.nix
@@ -52,7 +52,11 @@ in {
       aliasgroup2 = mkAlias "cloud.felschr.com";
       extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
     };
-    extraOptions = [ "--network=host" "--cap-add=MKNOD" ];
+    extraOptions = [
+      "--network=host"
+      "--cap-add=MKNOD"
+      "--label=io.containers.autoupdate=registry"
+    ];
   };
   services.nginx.virtualHosts."office.felschr.com" = {
     forceSSL = true;