What criteria do you use to decide between a rollback and a hotfix?

Question

Accepted Answer

Default to **rollback** — it's the fastest, most reliable way to restore a known-good state. Reach for a **hotfix** only when rollback is impossible or more dangerous than fixing forward. In an active incident, the priority is **stop the bleeding first**, diagnose later.

## The decision criteria

- **Is rollback safe and possible?** If the previous version is known-good and nothing irreversible has happened, roll back. This is the usual answer.
- **Did the bad release create irreversible state?** A **database migration** or data corruption can make rollback worse than the bug. If you can't safely go back, you must fix forward.
- **Do we understand the fix?** Rollback needs no diagnosis — that's its power. A hotfix you don't fully understand can deepen the incident; never ship a guess to prod under pressure.
- **Time to safe state.** Pick whichever path reaches stability fastest with least risk. A one-line, well-understood hotfix can beat a complex rollback; a risky forward-fix never beats a clean revert.
- **Blast radius and severity.** A full outage demands the fastest possible restore (usually rollback); a minor degradation may allow a careful hotfix.

## A quick decision table

| Situation | Choose |
| --- | --- |
| Previous version known-good, no migration | Rollback |
| Irreversible DB migration shipped | Hotfix / fix-forward |
| Cause unknown, severe impact | Rollback (buy time) |
| Trivial, well-understood one-liner | Hotfix |
| Rollback itself is risky/untested | Hotfix |

## Trade-offs and pitfalls

- **Rollback** is safe but only treats the symptom — you still owe a real fix and a postmortem.
- **Hotfix** addresses the root cause but skips the normal safety net; bugs in hotfixes are common precisely because they're rushed.
- **Untested rollback path** is a trap — if you've never rehearsed it, it may fail when you need it most. Practice rollbacks before you need them.
- Beware **debugging in production** under pressure; if you're more than a few minutes from a confident fix, roll back and investigate calmly.

## Why it matters

This decision happens at the worst possible moment — system down, clock running, everyone watching. A Tech Lead with a clear, rehearsed rule for it cuts MTTR dramatically and prevents the classic mistake of trying to be clever mid-incident when the boring revert was right there. Restore first, be smart afterward.

Situation	Choose
Previous version known-good, no migration	Rollback
Irreversible DB migration shipped	Hotfix / fix-forward
Cause unknown, severe impact	Rollback (buy time)
Trivial, well-understood one-liner	Hotfix
Rollback itself is risky/untested	Hotfix