For things like this, we maintain a fully separate one-page website with the same valid SSL certs as our app/site.
When it’s time for maintenance, we point DNS at that server, do our thing, and point it back. Requires a short TTL to make it worthwhile, but that works for us.
I suppose something like that could be done in a separate docker setup on the same host?