We actually update each machine while it is serving live traffic, with no downtime. We start a new instance of the server, warm it up (pre-load popular Workers

We actually update each machine while it is serving live traffic, with no downtime. We start a new instance of the server, warm it up (pre-load popular Workers), then move all new requests over to the new instance, while allowing the old instance to complete any requests that are in-flight. Fewer moving parts makes it really easy to push an update at any time. :)