Hotpatch is the one place in this subject where the answer genuinely got better, and it arrives by two unrelated routes with opposite acquisition models. On Azure you buy it at image-selection time; on Arc-connected machines it has been free since May 2026.
Every machine assessed on a schedule, tagged into a ring, running under a maintenance configuration, and one full patch cycle completed with WSUS still supplying every byte. That last clause is the proof that the schedule and the source are two separate levers.
The maintenance configuration is your change window turned into an Azure resource, which means it now has a location, a lifecycle and an owner. Ring membership is a tag query resolved at run time, so the tag is the second authority surface and almost nobody guards it.
WSUS is deprecated, ships in Server 2025, and is supported into the 2030s. That is not a burning platform, so the decision has to be argued on its merits rather than on the word, and this is the case both ways with the ruling.
Update Manager does not publish updates, cannot change where your servers get them, and does not touch a single client device. What it does own is the change window, and that is the part of patching that quietly changed hands.
