If I ever need to update any device on the home automation vlan, I'd add an exception to the firewall for this specific host for the time of the update