Zero-downtime deploys with Kubernetes and drush deploy

Sharing our current pipeline for bilingual sites at CDS. Rolling updates on Kubernetes with a pre-deploy Job:

apiVersion: batch/v1
kind: Job
metadata:
  name: drupal-deploy
spec:
  template:
    spec:
      containers:
        - name: drush
          image: registry.example/drupal:${SHA}
          command: ["drush", "deploy", "-y"]
      restartPolicy: Never

The tricky part is schema changes while old pods are still serving. How do others handle update hooks that aren't backwards compatible?