The solution that I recommend now is to have a separate staging site that shares an S3 backup bucket with the main site. You also want to see that the staging site won’t send email; an easy solution is to configure it with bogus SMTP settings.
With this in place, you can easily restore the most recent live data to the staging site and run an upgrade there. If it works, you run the upgrade on the main site. If you’re paranoid, you see what commit the staging site is running and enter that as the version in your yml file.