Skipped patches compound. A database three CPUs behind is not slightly out of date, it is a distinct configuration nobody has tested.
We standardise on out-of-place patching with a golden image per major version. Rollback becomes a home switch rather than a restore, which changes the risk conversation entirely.
Automated pre-checks catch the boring failures — space, invalid objects, stale statistics — the week before, not at two in the morning.
Then we rehearse on a clone with production-shaped data. A patch weekend should be the fourth time you have run the procedure, not the first.