nix flake update
nixos-rebuild --switch --flake .

# Just to keep an update history
git add flake.lock
git commit -m "update"

This may seem like too much work, but it guarantees an all-or-nothing procedure. If some package is broken, the entire upgrade process is canceled, and the system remains in the state that it was.

I have had a couple of partial upgrade cases on Arch. It was not fun live booting to repair it, every time this happened.