I use Ansible. Just have to be careful with the playbooks, so you won’t end up with a bricked system.

I run the playbooks once a week from one of the systems and takes care of them. In my case quite a number of them are always online (raspberry pi), so that’s convenient.

That has worked pretty well.