diff --git a/bin/apt_upgrade_and_restart_all b/bin/apt_upgrade_and_restart_all
new file mode 100755
index 0000000..873d396
--- /dev/null
+++ b/bin/apt_upgrade_and_restart_all
@@ -0,0 +1,63 @@
+#!/usr/bin/env python3
+
+from bundlewrap.repo import Repository
+from os.path import realpath, dirname
+from ipaddress import ip_interface
+
+repo = Repository(dirname(dirname(realpath(__file__))))
+nodes = [
+    node
+        for node in repo.nodes_in_group('debian')
+        if not node.dummy
+]
+
+print('updating nodes:', sorted(node.name for node in nodes))
+
+# UPDATE
+
+for node in nodes:
+    print('--------------------------------------')
+    print('updating', node.name)
+    print('--------------------------------------')
+    repo.libs.wol.wake(node)
+    print(node.run('DEBIAN_FRONTEND=noninteractive apt update').stdout.decode())
+    print(node.run('DEBIAN_FRONTEND=noninteractive apt -y dist-upgrade').stdout.decode())
+
+# REBOOT IN ORDER
+
+wireguard_servers = [
+    node
+        for node in nodes
+        if node.has_bundle('wireguard')
+        and (
+            ip_interface(node.metadata.get('wireguard/my_ip')).network.prefixlen <
+            ip_interface(node.metadata.get('wireguard/my_ip')).network.max_prefixlen
+        )
+]
+
+wireguard_s2s = [
+    node
+        for node in nodes
+        if node.has_bundle('wireguard')
+        and (
+            ip_interface(node.metadata.get('wireguard/my_ip')).network.prefixlen ==
+            ip_interface(node.metadata.get('wireguard/my_ip')).network.max_prefixlen
+        )
+]
+
+everything_else = [
+    node
+        for node in nodes
+        if not node.has_bundle('wireguard')
+]
+
+print('======================================')
+print(len(everything_else), len(wireguard_s2s), len(wireguard_servers))
+
+for node in [
+    *everything_else,
+    *wireguard_s2s,
+    *wireguard_servers,
+]:
+    print('rebooting', node.name)
+    print(node.run('systemctl reboot').stdout.decode())
diff --git a/hooks/wake_on_lan.py b/hooks/wake_on_lan.py
index 7a80e31..173d35c 100644
--- a/hooks/wake_on_lan.py
+++ b/hooks/wake_on_lan.py
@@ -1,14 +1,2 @@
-from bundlewrap.operations import run_local
-from bundlewrap.utils.ui import io
-from bundlewrap.utils.text import yellow, bold
-
-
 def node_apply_start(repo, node, interactive=False, **kwargs):
-    if node.has_bundle('wol-sleeper'):
-        io.stdout('{x} {node}  waking up...'.format(
-            x=yellow('!'),
-            node=bold(node.name)
-        ))
-        repo\
-            .get_node(node.metadata.get('wol-sleeper/waker'))\
-            .run(node.metadata.get('wol-sleeper/wake_command'))
+    repo.libs.wol.wake(node)
diff --git a/libs/wol.py b/libs/wol.py
new file mode 100644
index 0000000..d54cde8
--- /dev/null
+++ b/libs/wol.py
@@ -0,0 +1,13 @@
+from bundlewrap.utils.ui import io
+from bundlewrap.utils.text import yellow, bold
+
+def wake(node):
+    if node.has_bundle('wol-sleeper'):
+        io.stdout('{x} {node}  waking up...'.format(
+            x=yellow('!'),
+            node=bold(node.name)
+        ))
+        node\
+            .repo\
+            .get_node(node.metadata.get('wol-sleeper/waker'))\
+            .run(node.metadata.get('wol-sleeper/wake_command'))