• Choose a suitable target system
  • Verify local reachability
  • Record version and startup path
  • After boot: diagnostics first, then security

Practical rule

Change only as much at once as you can trace and roll back if needed.