A cloud provider must apply an urgent security patch to the hypervisor kernel across a cluster of hosts running thousands of tenant VMs. The security team requires that the patch be applied without extended tenant downtime and without exposing running workloads to the unpatched code. Which capability of the underlying virtualization infrastructure BEST enables the provider to meet this requirement?