Hotpatch updates are Windows updates that carry security fixes only and are designed to install without a restart. According to Microsoft's release cycle documentation, a quarterly baseline update with a restart brings devices up to date, and the two following monthly security updates are meant to install without one.
What Microsoft says
Microsoft's page on the Windows client update release cycle describes hotpatching in a short passage. IT admins can enroll devices in hotpatch updates for a faster time to compliance. Hotpatch updates include security fixes only, without the additional features and enhancements in a regular monthly security update.
A quarterly baseline, which is a monthly security update with a restart, is required to bring devices up to date on all the features. After that, the design is that the two subsequent monthly security updates install without requiring a restart.
What this means in a calendar
Treat the quarter as three steps.
| Month in the quarter | Update type | Restart expected |
|---|---|---|
| First | Baseline, a full monthly security update | Yes |
| Second | Hotpatch, security fixes only | No, by design |
| Third | Hotpatch, security fixes only | No, by design |
The words "by design" matter. Microsoft describes the intent. Plan for exceptions, for example when a fix cannot be applied in memory, and keep a normal restart procedure ready.
Who benefits
Hotpatching helps where restarts are expensive: servers that run all day, systems with long boot or warm-up times, and environments where change windows are rare. It shortens the time a known fix sits uninstalled, which supports the usual goal of reaching compliance faster.
It does not remove the work around the update. You still read the release notes, still pilot, and still verify that the fix landed.
Questions to ask before enrolling
- Which of our systems are eligible? Check Microsoft's current requirements for your Windows version before assuming.
- Do we need the non-security content that hotpatch omits? If yes, the baseline month carries it.
- How will we verify each machine's patch state? Make sure your reporting distinguishes baseline from hotpatch builds.
- What is our fallback if a hotpatch fails to apply? Document who decides to restart and when.
- Do our compliance commitments name a patch deadline? Hotpatching can help meet it, but you must still show evidence.
Keep the baseline on the calendar
The baseline month is the one that can disrupt you. Put it on the same shared calendar as Patch Tuesday, and treat it as a normal full update with a pilot ring and a restart window. See our explainer on Patch Tuesday dates for how the monthly cycle fits together.
Other patching routes
Hotpatch is one of several ways to shorten restart exposure. Other platforms have their own methods, such as live kernel patching on some Linux distributions, which Ubuntu lists among the features of its Ubuntu Pro subscription. Each has its own limits, so read the vendor's description before you rely on it for a deadline.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how a fix that is available gets turned into a change you can ship, which is the step that hotpatching speeds up.
Safeguard covers dependency and container image scanning and autonomous remediation with fix PRs, which is off by default with every category on Manual. A free scan shows what a fix looks like for a project.
Quick check
Does hotpatch include feature updates?
No. Microsoft says hotpatch updates include security fixes only.
Do I ever need to restart with hotpatch?
Yes. The quarterly baseline month includes a restart, and exceptions can occur in other months.
Sources
- Microsoft Learn, Update release cycle for Windows clients
- Ubuntu, About CVEs
Last reviewed: 19 October 2026.
