I create a BE before every major update. I have never had an update lock me out of SSH, so I could always roll back if anything wasn't working.
I could not, but good for you.
What's keeping you from making bectl create before-upgrade-20231216 a regular part of your update routine? That's all it takes.