&gt; I didn&#x27;t have any update-induced downtimes yet, except for the usual reboots to apply kernel upgrades<p>Wait until the first major backwards-incompatible config format change breaks something. Puppet was one example of many.<p>&gt; My solution is to package that software myself in a private repo, so that I get to decide when to upgrade.<p>Works fine for single applications, breaks horribly for system-wide shared libraries.