So....

Why not just fail over to the secondary full time, so that you can upgrade the primary offline. If all goes well, fail back to the primary, if not, the secondary keeps on running until the issues are resolved? No down time at all.