staged releases. don't cripple all your systems in one go. hot backups that you only update after the main system isn't dead from an update.