Putting back online SQL AlwaysOn servers
Here is how I see it.

Patch &amp; upgrade the secondary/passive node first

after this do a failover and check if everything is still working like it should.(this can mean waiting a week) If this is the case, then you can proceed with patching the other node.

If this is not the case you can fallback to your old node and revert the changes done on the other server, and get them back into sync.

I would definitely not patch both nodes at the same moment

IMPORTANT: make sure you can take the hit on your logspace because during the downtime of your secondary node you will not have any log truncation

Also make sure you have your Quorum settings configured properly, otherwise you might have some issues on your cluster level!