Don't you reboot servers to get kernel security updates? I usually have unattended upgrades with the option to reboot during the night if necessary