Shipping on Fridays Is Fine If Your Rollback Takes 90 Seconds

Every few months someone posts the same meme: a calendar with Friday crossed out and the words never deploy on Friday. Every few months the comments split into two camps, and both are partly right.

I want to argue that the real question is not which day you deploy. It is how long it takes you to undo a deploy.

The number nobody measures

A year ago I asked my team a simple question: if the last release broke checkout, how long until it is fixed? The answers ranged from five minutes to depends who is online. We timed it. The real answer was 23 minutes, mostly spent figuring out which commit to revert, waiting for a full CI run, and then waiting for a rolling deploy.

Twenty-three minutes of broken checkout on a Friday evening is bad. On a Tuesday morning it is also bad. The day was never the issue.

What we changed

We set a target: any release can be rolled back in under 90 seconds by any engineer, without thinking.

Getting there took about six weeks:

1. Immutable builds. Every merged commit produces a tagged container image. Rolling back means pointing at the previous tag, not rebuilding anything.
2. One command. We wrote a tiny script, deploy rollback, that flips traffic to the last known-good image. No arguments, no choices.
3. Backward-compatible migrations. This was the hard part. Every schema change now ships in two steps: add the new column, deploy code that uses it, and only remove the old one a week later. Rolling back code never conflicts with the database.
4. Feature flags for risky changes. Anything touching payments ships dark and is turned on separately. Turning it off is faster than any rollback.

The results

Our measured rollback time is now 70 to 85 seconds. We practise it once a sprint on staging, and once a month on production during a quiet hour.

Something unexpected happened: we started deploying more often, about eight times a day instead of twice. Smaller deploys meant smaller blast radius, which meant rollbacks were rarely needed in the first place.

So, Fridays?

We still have one rule. Nobody ships a large, risky change at 6pm and then logs off. That is not a Friday rule, though. It is a stay around for an hour after you deploy rule, and it applies every day.

A deploy freeze is an admission that your recovery is too slow. Sometimes that is honest. It should never be permanent.

If your team is afraid of Friday, measure your rollback time this week. If it is under two minutes, Friday is just another day. If it is over twenty, Monday should scare you too.

Cover: Photo by SpaceX on Unsplash.