Are they running on bare metal? I'd say don't patch and only run pg and redis on the machine. They should still be secure, no?