On Linux (with a good it department), pending app/os updates get pulled to testing machine, test to make sure it still works, have supported machines pull down that version.

This is in no way unique to Linux.