I find the advice from the docs and the mailing list to not quite align with what I have seen when maintaining a binary install (on Debian variannts) and so I include a snippet from my system update script below for your review:
if command -v guix 2>&1 > /dev/null; then
(set -x;
sudo su -l -c 'guix pull --timeout=0 && \
guix install guix glibc-locales nss-certs && \
guix upgrade --timeout=0 && \
guix gc --delete-generations=1m')
...
fi
Something like that is the only way I’ve ever gotten a binary install to reliably update.