@derfux:

Did you suspend (stop) the failover on the secondary node, before shutdown? Cause there's the option to stop the failover on the secondary node. I just want to get sure that that might be the best way in case of updates.