What's your go-to approach when a package update breaks a running service in production

I've been running a few small services on a Debian server for personal projects and recently had a bad experience where an unattended upgrade pulled in a new version of a dependency that broke one of my containers until I tracked it down and rolled back. It got me thinking about how people handle this more systematically. Do you pin packages aggressively, run everything in containers with frozen base images, or just accept the risk and monitor closely? I'm not running anything mission critical but I'd like to adopt better habits before I scale up. Curious what workflows people here use for balancing security updates with stability on servers that actually need to stay running.