I should have done this from the beginning: https://github.com/chenxiaolong/avbroot/blob/master/README.md

Yes, OTA updates must be patched manually but I'm sure I can create some automation to make it easier.