How do you deal with OS updates on servers you can't afford to break?

I run a few VPS with webapps on them (Coolify + Docker). I'm a developer, not a sysadmin, and every time I think about updating the host OS I find a reason to do it next week instead. Last time I did it, a service came back up but one container didn't, and I found out days later because nobody complained immediately. Since then I mostly just don't touch them, which I know is worse. So, genuinely curious how other people handle this: do you update the host at all, or run it until the LTS goes EOL and rebuild? has an update ever actually broken something for you? what broke? when it broke, did you roll back or just fix it in place? do you snapshot first, or just hope? Not looking for "use Ansible" - I'm sure that's right, I just want to know what people actually do in practice.