You don’t even technically need to reboot, I think you can just live-apply in the active container and get the updates. Rebooting is the best way though, since it confirms the new image in bootable