"We can always roll back" is one of those sentences everyone says and few have tested. For code alone it is genuinely simple. The moment a release touches the database, it stops being simple and starts being a decision.
Code is the easy half
If your deployment is a container image, rollback is starting the previous image. One command, seconds, no drama — provided the previous image still exists and you know which one it was. That is why images should be tagged with the commit that built them: at 3am you need to know what was running before, and human memory is not a version control system.
The database is the hard half
A release that adds a column is safe to roll back. A release that renames or removes one is not: the old code does not know about the change, and the new data may no longer fit the old shape.
The technique that makes this survivable is boring and effective — never do a destructive schema change in the same release as the code that needs it:
1. Release one adds the new column and writes to both.
2. Release two switches reads to the new column.
3. Release three, days later, stops writing the old one and eventually drops it.
Each step is individually reversible. It is more work than a single migration, and it is the difference between "roll back" being a command and being a meeting.
Practise it before you need it
The first rollback should never happen during an incident. It should happen on a quiet Tuesday, deliberately, with the team watching, so everyone has seen it work and knows how long it takes. We do this as part of every setup for exactly one reason: an untested rollback is a paragraph in a document, and documents do not restore service.
And know when not to
Sometimes rolling back is wrong. If the release has already written data the old code cannot read, going backwards can lose it. That is why the safest posture is a system where forward fixes are fast — a pipeline that ships a correction in minutes reduces how often you need to reverse anything at all. That pipeline is the point of the two-week setup: minutes to ship a fix, so rolling back stays the rare option rather than the routine one. Keeping that pipeline current after the setup is what our software maintenance services cover, if you want them.
Worth reading alongside it: what to monitor on a small product, and what to ignore.