Or more specifically, if it’s a controlled IT environment and you rely on centrally vetted and controlled software updates (which makes sense in a lot of contexts), then, well, control them centrally.

As in, either they update on their own, or every weekend the devices stay with IT anyways and get updated.