For updates, you can do your classic blue-green deployment: wind down traffic for instance (remove from load balancer etc), wait until it finishes outstanding jobs, deploy update, resume routing traffic, repeat for every instance (or do it in groups).