diff --git a/Property/Apt.hs b/Property/Apt.hs
index d9d4ed2..98dc354 100644
--- a/Property/Apt.hs
+++ b/Property/Apt.hs
@@ -51,7 +51,7 @@ update :: Property
 update = cmdProperty "apt-get" [Param "update"]
 
 upgrade :: Property
-upgrade = cmdProperty "apt-get" [Params "-y safe-update"]
+upgrade = cmdProperty "apt-get" [Params "-y safe-upgrade"]
 
 type Package = String
 
diff --git a/TODO b/TODO
index 4617c2b..02283f0 100644
--- a/TODO
+++ b/TODO
@@ -2,3 +2,4 @@
   run it once for the whole. For example, may want to restart apache,
   but only once despite many config changes being made to satisfy
   properties. onChange is a poor substitute.
+* Apt upgrade does not avoid apt-listchanges and debconf prompts.