It should already work. Spamassasin installs a script in cron.daily that runs sa-update and recompiles the rules.
It’s here: /etc/cron.daily/spamassassin
Runs the command like so: su - debian-spamd -c "sa-update --gpghomedir /var/lib/spamassassin/sa-update-keys"