Currently all containers already have the "io.containers.autoupdate" = "registry"; label.
By enabling the podman-auto-update.timer systemd timer [1] , I could have unattended updates.
These run daily by default, but maybe weekly is better.
I have to set image tags carefully to avoid breaking changes.
[1] systemctl --user enable --now podman-auto-update.timer