diff --git a/bundles/apt/files/upgrade-and-reboot.conf b/bundles/apt/files/upgrade-and-reboot.conf
index 9bfbd39..ca71dce 100644
--- a/bundles/apt/files/upgrade-and-reboot.conf
+++ b/bundles/apt/files/upgrade-and-reboot.conf
@@ -1,3 +1,3 @@
 nodename="${node.name}"
 reboot_mail_to="${node.metadata.get('apt/unattended-upgrades/reboot_mail_to', '')}"
-auto_reboot_enabled="${node.metadata.get('apt/unattended-upgrades/reboot-enabled', True)}"
+auto_reboot_enabled="${node.metadata.get('apt/unattended-upgrades/reboot_enabled', True)}"
diff --git a/bundles/apt/metadata.py b/bundles/apt/metadata.py
index ecb0775..0a7dff5 100644
--- a/bundles/apt/metadata.py
+++ b/bundles/apt/metadata.py
@@ -1,6 +1,6 @@
 defaults = {
     'apt': {
-        'unattended_upgrades': {
+        'unattended-upgrades': {
             'day': 5,
             'hour': 21,
         },
@@ -21,8 +21,8 @@ defaults = {
     'cron/upgrade-and-reboot'
 )
 def patchday(metadata):
-    day = metadata.get('apt/unattended_upgrades/day')
-    hour = metadata.get('apt/unattended_upgrades/hour')
+    day = metadata.get('apt/unattended-upgrades/day')
+    hour = metadata.get('apt/unattended-upgrades/hour')
 
     return {
         'cron': {
diff --git a/bundles/c3voc-addons/metadata.py b/bundles/c3voc-addons/metadata.py
index e0947c7..1665a0c 100644
--- a/bundles/c3voc-addons/metadata.py
+++ b/bundles/c3voc-addons/metadata.py
@@ -1,6 +1,6 @@
 defaults = {
     'apt': {
-        'unattended_upgrades': {
+        'unattended-upgrades': {
             'day': 5,
             'hour': 21,
         },
@@ -28,8 +28,8 @@ defaults = {
     'cron/upgrade-and-reboot'
 )
 def patchday(metadata):
-    day = metadata.get('apt/unattended_upgrades/day')
-    hour = metadata.get('apt/unattended_upgrades/hour')
+    day = metadata.get('apt/unattended-upgrades/day')
+    hour = metadata.get('apt/unattended-upgrades/hour')
 
     return {
         'cron': {
diff --git a/bundles/icinga2/files/icinga2/downtimes.conf b/bundles/icinga2/files/icinga2/downtimes.conf
index f0febda..a4dd0b0 100644
--- a/bundles/icinga2/files/icinga2/downtimes.conf
+++ b/bundles/icinga2/files/icinga2/downtimes.conf
@@ -9,7 +9,7 @@ object ScheduledDowntime "unattended_upgrades" {
     fixed = true
 
     ranges = {
-        "${days[monitored_node.metadata.get('apt/unattended_upgrades/day')]}" = "${monitored_node.metadata.get('apt/unattended_upgrades/hour')}:${monitored_node.magic_number%30}-${monitored_node.metadata.get('apt/unattended_upgrades/hour')}:${(monitored_node.magic_number%30)+30}"
+        "${days[monitored_node.metadata.get('apt/unattended-upgrades/day')]}" = "${monitored_node.metadata.get('apt/unattended-upgrades/hour')}:${monitored_node.magic_number%30}-${monitored_node.metadata.get('apt/unattended-upgrades/hour')}:${(monitored_node.magic_number%30)+30}"
     }
 
     child_options = "DowntimeTriggeredChildren"
diff --git a/groups/locations.py b/groups/locations.py
index dd86b36..94d7d8d 100644
--- a/groups/locations.py
+++ b/groups/locations.py
@@ -110,6 +110,13 @@ groups['voc'] = {
         r"voc\..*",
     },
     'metadata': {
+        'apt': {
+            # Move patchday to somewhere where the possibility of
+            # clashing with actual events is less likely.
+            'unattended-upgrades': {
+                'day': 1,
+            },
+        },
         'location': 'voc',
     },
 }
diff --git a/groups/os.py b/groups/os.py
index c17190d..f484055 100644
--- a/groups/os.py
+++ b/groups/os.py
@@ -34,7 +34,7 @@ groups['linux'] = {
     'metadata': {
         'apt': {
             'unattended-upgrades': {
-                'mail': libs.defaults.hostmaster_email,
+                'reboot_mail_to': libs.defaults.hostmaster_email,
             },
         },
         'backup-client': {
diff --git a/hooks/test_metadata_dashes_vs_underscores.py b/hooks/test_metadata_dashes_vs_underscores.py
new file mode 100644
index 0000000..698ab56
--- /dev/null
+++ b/hooks/test_metadata_dashes_vs_underscores.py
@@ -0,0 +1,45 @@
+from collections.abc import Mapping
+
+from bundlewrap.exceptions import BundleError
+from bundlewrap.utils.text import bold, green
+from bundlewrap.utils.ui import io
+
+def test_underscore_vs_dash(node, metadata, path=[]):
+    for k, v in metadata.items():
+        if not isinstance(k, str):
+            continue
+
+        all_dashes = k.replace('_', '-')
+        all_underscores = k.replace('-', '_')
+
+        if k != all_dashes and all_dashes in metadata:
+            raise BundleError('{n} metadata contains both {k} and {p}'.format(
+                n=node.name,
+                k='/'.join(path + [k]),
+                p='/'.join(path + [all_dashes]),
+            ))
+
+        if k != all_underscores and all_underscores in metadata:
+            raise BundleError('{n} metadata contains both {k} and {p}'.format(
+                n=node.name,
+                k='/'.join(path + [k]),
+                p='/'.join(path + [all_underscores]),
+            ))
+
+        if isinstance(v, Mapping):
+            test_underscore_vs_dash(
+                node,
+                v,
+                path + [k],
+            )
+
+def test_node(repo, node, **kwargs):
+    test_underscore_vs_dash(
+        node,
+        node.metadata.get(tuple()),
+    )
+
+    io.stdout('{x} {node}  metadata contains no dashes-vs-underscores errors'.format(
+        x=green("✓"),
+        node=bold(node.name),
+    ))
diff --git a/nodes/home/kodi-wohnzimmer.py b/nodes/home/kodi-wohnzimmer.py
index 5c0ad07..d91fca5 100644
--- a/nodes/home/kodi-wohnzimmer.py
+++ b/nodes/home/kodi-wohnzimmer.py
@@ -14,7 +14,7 @@ nodes['home.kodi-wohnzimmer'] = {
             'packages': {
                 'intel-media-va-driver-non-free': {},
             },
-            'unattended_upgrades': {
+            'unattended-upgrades': {
                 'day': 6,
                 'hour': 2,
             },
diff --git a/nodes/home/nas.py b/nodes/home/nas.py
index 07b0e92..08e2477 100644
--- a/nodes/home/nas.py
+++ b/nodes/home/nas.py
@@ -26,10 +26,10 @@ nodes['home.nas'] = {
             },
         },
         'apt': {
-            'unattended_upgrades': {
+            'unattended-upgrades': {
                 'day': 6,
                 # requires manual decryption of zfs after reboot
-                'reboot-enabled': False,
+                'reboot_enabled': False,
             },
             'packages': {
                 'mpv': {},
diff --git a/nodes/htz-hel/backup-kunsi.py b/nodes/htz-hel/backup-kunsi.py
index 17f29b4..71d65c8 100644
--- a/nodes/htz-hel/backup-kunsi.py
+++ b/nodes/htz-hel/backup-kunsi.py
@@ -13,7 +13,7 @@ nodes['htz-hel.backup-kunsi'] = {
             'unattended-upgrades': {
                 # requires manual apply after reboot to unlock dm-crypt
                 # devices
-                'reboot-enabled': False,
+                'reboot_enabled': False,
             },
         },
         'interfaces': {
diff --git a/nodes/htz-hel/backup-sophie.py b/nodes/htz-hel/backup-sophie.py
index 655863a..d235d0a 100644
--- a/nodes/htz-hel/backup-sophie.py
+++ b/nodes/htz-hel/backup-sophie.py
@@ -16,7 +16,7 @@ nodes['htz-hel.backup-sophie'] = {
             'unattended-upgrades': {
                 # requires manual apply after reboot to unlock dm-crypt
                 # devices
-                'reboot-enabled': False,
+                'reboot_enabled': False,
             },
         },
         'backups': {
diff --git a/nodes/voc/infobeamer-cms.py b/nodes/voc/infobeamer-cms.py
index 9333374..e03e6f8 100644
--- a/nodes/voc/infobeamer-cms.py
+++ b/nodes/voc/infobeamer-cms.py
@@ -9,13 +9,6 @@ nodes['voc.infobeamer-cms'] = {
         'webserver',
     },
     'metadata': {
-        'apt': {
-            # Move patchday to somewhere where the possibility of
-            # clashing with actual events is less likely.
-            'unattended_upgrades': {
-                'day': 1,
-            },
-        },
         'backups': {
             'exclude_from_backups': True,
         },
diff --git a/nodes/voc/pretalx.py b/nodes/voc/pretalx.py
index 5a4e82d..0f8ead6 100644
--- a/nodes/voc/pretalx.py
+++ b/nodes/voc/pretalx.py
@@ -14,13 +14,6 @@ nodes['voc.pretalx'] = {
         'sshmon',
     },
     'metadata': {
-        'apt': {
-            # Move patchday to somewhere where the possibility of
-            # clashing with actual events is less likely.
-            'unattended_upgrades': {
-                'day': 1,
-            },
-        },
         'check-mail-received': {
             't-online': {
                 'email': 'franzi.kunsmann@t-online.de',