The correct solution is to have IT force push updates only when they deem fit (after they have tested internally on some ghost machines).