diff -Nru unattended-upgrades-0.93.1ubuntu2.2/debian/changelog unattended-upgrades-0.93.1ubuntu2.3/debian/changelog
--- unattended-upgrades-0.93.1ubuntu2.2/debian/changelog	2017-05-03 01:44:58.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/debian/changelog	2017-07-31 19:40:12.000000000 +0000
@@ -1,3 +1,12 @@
+unattended-upgrades (0.93.1ubuntu2.3) zesty; urgency=medium
+
+  * Cherry-pick 2e5deed, f26edb4 from upstream to add support for a
+    --download-only option, enabling us to download updates at a random time
+    of day by default but apply them predictably in the 6am-7am window.
+    LP: #1686470.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 31 Jul 2017 12:40:12 -0700
+
 unattended-upgrades (0.93.1ubuntu2.2) zesty; urgency=medium
 
   * Add UbuntuESM to the list of sources automatically upgraded from by
diff -Nru unattended-upgrades-0.93.1ubuntu2.2/test/test_in_chroot.py unattended-upgrades-0.93.1ubuntu2.3/test/test_in_chroot.py
--- unattended-upgrades-0.93.1ubuntu2.2/test/test_in_chroot.py	2016-12-11 10:31:26.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/test/test_in_chroot.py	2017-07-31 19:39:26.000000000 +0000
@@ -54,6 +54,7 @@
     debug = False
     verbose = True
     apt_debug = False
+    download_only = False
     dry_run = False
     minimal_upgrade_steps = False
 
diff -Nru unattended-upgrades-0.93.1ubuntu2.2/test/test_remove_unused.py unattended-upgrades-0.93.1ubuntu2.3/test/test_remove_unused.py
--- unattended-upgrades-0.93.1ubuntu2.2/test/test_remove_unused.py	2016-12-11 10:31:26.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/test/test_remove_unused.py	2017-07-31 19:39:26.000000000 +0000
@@ -14,6 +14,7 @@
 class MockOptions(object):
     debug = False
     verbose = False
+    download_only = False
     dry_run = False
     apt_debug = False
     minimal_upgrade_steps = False
diff -Nru unattended-upgrades-0.93.1ubuntu2.2/test/test_rewind.py unattended-upgrades-0.93.1ubuntu2.3/test/test_rewind.py
--- unattended-upgrades-0.93.1ubuntu2.2/test/test_rewind.py	2016-12-11 10:31:26.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/test/test_rewind.py	2017-07-31 19:39:27.000000000 +0000
@@ -13,6 +13,7 @@
 class MockOptions(object):
     debug = False
     verbose = False
+    download_only = False
     dry_run = True
     apt_debug = False
     minimal_upgrade_steps = False
diff -Nru unattended-upgrades-0.93.1ubuntu2.2/test/test_untrusted.py unattended-upgrades-0.93.1ubuntu2.3/test/test_untrusted.py
--- unattended-upgrades-0.93.1ubuntu2.2/test/test_untrusted.py	2016-12-11 10:31:26.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/test/test_untrusted.py	2017-07-31 19:39:27.000000000 +0000
@@ -13,6 +13,7 @@
 class MockOptions(object):
     debug = True
     verbose = False
+    download_only = False
     dry_run = True
     apt_debug = False
     minimal_upgrade_steps = False
diff -Nru unattended-upgrades-0.93.1ubuntu2.2/test/unattended_upgrade.py unattended-upgrades-0.93.1ubuntu2.3/test/unattended_upgrade.py
--- unattended-upgrades-0.93.1ubuntu2.2/test/unattended_upgrade.py	2017-02-24 21:23:23.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/test/unattended_upgrade.py	2017-07-31 19:39:25.000000000 +0000
@@ -1320,6 +1320,9 @@
     res = fetcher.run()
     logging.debug("fetch.run() result: %s", res)
 
+    if options.download_only:
+        return
+
     if dpkg_conffile_prompt():
         # now check the downloaded debs for conffile conflicts and build
         # a blacklist
@@ -1528,6 +1531,9 @@
     parser.add_option("", "--dry-run",
                       action="store_true", default=False,
                       help=_("Simulation, download but do not install"))
+    parser.add_option("", "--download-only",
+                      action="store_true", default=False,
+                      help=_("Only download, do not even try to install."))
     parser.add_option("", "--minimal-upgrade-steps",
                       action="store_true", default=False,
                       help=_("Upgrade in minimal steps (and allow "
diff -Nru unattended-upgrades-0.93.1ubuntu2.2/unattended-upgrade unattended-upgrades-0.93.1ubuntu2.3/unattended-upgrade
--- unattended-upgrades-0.93.1ubuntu2.2/unattended-upgrade	2017-02-24 21:23:23.000000000 +0000
+++ unattended-upgrades-0.93.1ubuntu2.3/unattended-upgrade	2017-07-31 19:39:25.000000000 +0000
@@ -1320,6 +1320,9 @@
     res = fetcher.run()
     logging.debug("fetch.run() result: %s", res)
 
+    if options.download_only:
+        return
+
     if dpkg_conffile_prompt():
         # now check the downloaded debs for conffile conflicts and build
         # a blacklist
@@ -1528,6 +1531,9 @@
     parser.add_option("", "--dry-run",
                       action="store_true", default=False,
                       help=_("Simulation, download but do not install"))
+    parser.add_option("", "--download-only",
+                      action="store_true", default=False,
+                      help=_("Only download, do not even try to install."))
     parser.add_option("", "--minimal-upgrade-steps",
                       action="store_true", default=False,
                       help=_("Upgrade in minimal steps (and allow "