I kept a mostly "if it works don't break it" approach, but about once a year there'd be some alert about security issues with some specific software and I'd run

I kept a mostly "if it works don't break it" approach, but about once a year there'd be some alert about security issues with some specific software and I'd run a "aptitude update". Invariably it'd update the packages out of order, libc would get screwed up, and I'd have to reinstall the whole server. What distribution are you using? I've never had this happen, though for important servers I tend to use Debian stable. I would be shocked if it happened on stable.