Correct, run a patched node in front of your preferred version to mitigate any remote vulnerabilities. Also a great way to quickly identify if consensus changes result in a chain split.