If you don't have a dedicated sysadmin who's always on top of new Gitlab versions, then the alternative to automatic upgrades is letting insecure versions run for an arbitrary time until someone takes the time to upgrade. Gitlab is merely 1 of the 200 things we have to keep track of.

Besides, we already make weekly automatic backups, stored remotely and encrypted. And Gitlab automatically makes a locally-stored backup before each upgrade, which is good enough unless the disk fails right after we discover that the upgrade is broken.

You can configure just security patches and not full upgrades.

What about automatic security APT updates?

Or just before the upgrade?

That's how we do it— snapshot the box, apt dist-upgrade, snapshot again, gitlab upgrade, snapshot again.

A few days later, drop the snapshots.