With two people who know production, freeze changes from Friday 18 December, put a paid human on call only for systems that lose money or data when they fail, and let the rest wait. Decide by about 20 November whether to buy a third person, and start them by 30 November (8 December at the latest). In our judgment, someone who starts later can't shadow a deploy and a runbook before the 18th.
Should a team with two production experts freeze, run a rota or buy cover?
Freeze always, add a rota when a tier-1 system exists, and buy cover when only one owner of it is reachable. Small teams do split on this. Pragmatic Engineer's 2023 reader survey (185 responses) has small companies on both sides: a bootstrapped FinTech freezing 23 December to 2 January, and a 50-person startup that only makes the minimum changes over the break. Both are defensible, so you're choosing by risk, not by what's normal.
| Option | Pick it when |
|---|---|
| Freeze only | No system loses money or data overnight |
| Freeze plus thin rota | A tier-1 system exists and two owners are reachable |
| Freeze plus bought-in cover | Only one tier-1 owner is reachable on 5 or more days |
Most two-expert teams will land in the middle row, the lowest-cost option that still puts a person on the systems that matter.
How long should the freeze be, and what still ships?
Pick the dates
The 2026 calendar does most of the work. Our pick: last deploy on Friday 18 December, freeze through Sunday 3 January, first release on Tuesday 5 January once everyone's back and rested. The quiet stretch inside that window runs from Tuesday 22 December to Saturday 2 January. In the UK the week of 28 December holds two bank holidays, so the freeze costs less shipping than it sounds.
If you're in the UK, gov.uk lists bank holidays on Friday 25 December, Monday 28 December (the Boxing Day substitute) and Friday 1 January 2027, with Scotland also off on Monday 4 January. Elsewhere, check your own country's calendar.
If you ship a mobile app, plan for the store too. In 2023 Apple said reviews may take longer from 22 to 27 December, so submit by the 18th and check Apple's 2026 notice, usually posted late November or early December.
What ships anyway
Name one exception approver, a person rather than a channel. Three things qualify: security patches, a bug that blocks revenue, and content or config changes that need no deploy. Everything else waits for January.
The UK Ministry of Justice's technical guidance argues against freezes in general. It allows them only when six conditions all hold, among them one system, a few days at most, no other work planned and a documented exception route. Your freeze is longer than that, which is why the approver and the tier list below matter more than the dates.
What a freeze doesn't protect you from
FireHydrant argues freezes don't reduce incidents, they move them. Incidents are harder to diagnose because nothing recently changed, and January brings a rush of batched deploys. Plan your first week back around small releases, and settle naming a rollback owner and the ship or no-ship call before the freeze starts.
Which systems need a human on call at all?
List every system by what it costs when it's down for a day, then sort into three tiers.
- Page a human when money or customer data is at risk: a payments webhook, the production database, anything that bills.
- Check once a day for the marketing site, internal tools and dashboards. Whoever is on cover looks each morning and each evening.
- Let it wait when nothing breaks that a customer would notice before January.
Then cut alerts before anyone leaves. Open last year's alert history for 22 December to 2 January and delete or downgrade every alert that wouldn't make you get out of bed. A tier-3 alert that pages at 3 a.m. is how a good rota gets resented.
What do we check before people leave?
Start the checklist on 8 December and finish it on the day of the last deploy.
- 8 December: every cover person logs in to production, the cloud console and the paging app from a laptop that isn't the office one. Confirm 2FA devices are with them, not in a drawer at work.
- 11 December: someone other than the author runs each tier-1 runbook start to finish. If they get stuck, the runbook is the bug. This is the same test as in a no-leaver drill for runbooks.
- 15 December: restore a backup into a scratch environment. A backup nobody has restored is a hope.
- 16 December: name the rollback owner for each tier-1 system, and write down who can reach the cloud and vendor billing accounts if a card expires.
- 18 December: last deploy. Alert cleanup is done, the cover calendar is shared and a one-page contact sheet is pinned where the cover person will see it.
What do we owe the people covering?
A day off in lieu for each covered day, taken in January. Terminal.io's holiday guide suggests extra days off for engineers who cover Thanksgiving, Christmas or New Year's Eve, and adding a backup. Split the load across Christmas, New Year and the days between so nobody gets all three. The ratio is our judgment, not a standard.
In the UK, Acas says on-call time can count as working time when the worker has to do contract work, and the contract should state whether on-call is paid. In the EU or elsewhere, check local rules with someone who knows them. Swap rules, recovery after a night page and pay are laid out in setting up the on-call rotation itself. If a contractor is on your rota, their contract sets what they're paid and when they're reachable, so read it first.
When should we buy cover, and how early?
Buy cover when the trigger in the table above fires. Otherwise the rota is enough.
A worked example. Eight engineers, with Ana and Ben holding deploys, the database and billing. One platform engineer, and five others who know the product but not production. Tier 1 is the payments webhook and the database. Tier 2 is the marketing site and internal tools.
The plan: Ana covers 22 to 27 December, Ben covers 28 December to 3 January, the platform engineer is secondary, and each earns a day off in lieu per covered day. Then Ana mentions family leave from 29 December to 2 January. For five days only Ben is reachable, so the trigger fires. The team decides by 20 November and a contractor starts Monday 30 November.
Why that early? The contractor needs to shadow a real deploy, run a tier-1 runbook and ship one small non-critical fix before 18 December. Our onboarding guide puts a contractor's first pull request at day 3 to 5. Overlap is what interim cover really buys, so a start date after 8 December buys you a name and nothing else.
HighCircl can match an engineer in 72 hours with no minimum hour commitment, so a 20 November decision still leaves time to start by 30 November.
What this means for your holiday plan
You're deciding two things by 20 November, and neither is technical. One is how much risk you'll carry through 3 January: which systems get a human, which get a daily glance, which wait. The other is whether one absence can leave a tier-1 system with nobody reachable. If it can, the cost of cover is a contract with a start date no later than 30 November, set against a missed incident over Christmas that costs revenue and customer trust.
Put four dates in a shared calendar: the cover decision on 20 November, the checklist start on 8 December, the last deploy on 18 December and the first release on 5 January. Then name the exception approver. For more on running a team through moments like this, start with engineering management guides for CTOs and VPs of engineering.
FAQ
Is a code freeze worth it for a small team?
Yes, if the freeze is short and has a named exception approver and a rollback owner. FireHydrant argues freezes don't reduce incidents, only move them, so the plan is about being ready, not about avoiding change.
How long before Christmas should we start the freeze?
We'd make Friday 18 December the last deploy and freeze through Sunday 3 January. That keeps the holiday weeks free of releases. Mobile teams should submit by the 18th, since Apple slowed reviews on 22 to 27 December in 2023.
Do we have to pay people for on-call over the holidays?
In the UK, Acas says on-call can count as working time when the worker must do contract work, and the contract should say whether it's paid. In the EU or elsewhere, the answer depends on local law and the contract, so ask counsel before you assume. Either way, a day off in lieu is a cheap way to be fair.
Can we skip on-call entirely?
Some do. Pragmatic Engineer describes a five-engineer security startup with no on-call, where leaders step in. The CTO says the stack never needs attention. If you have a tier-1 system, that isn't your situation.