How do you migrate paying customers without downtime?

We run the old stack and the new stack in parallel during cutover. Customers migrate one at a time over 48–72 hours, scheduled for low-traffic windows in their timezone. The old stack stays warm for 72 hours after cutover in case we need to fail back. Average churn during our last three rescues was zero.