Why don’t you update dev+qa at the same time? Or qa+sandbox? Or dev+qa+sandbox? Separating these 3 might make sense for the applicative part (and even then, I think 4 environments is too many), but I’m not sure it really make sense to follow it on the infra side.

I’m also not sure of why you manage all these clusters, why not merging dev, qa and sandbox in a single cluster with namespace partitioning? It would be way less work and probably more cost effective