looking at the official instructions as well as some user examples, it appears the process is supposed to consist of pealing the secondary pan off the existing deployment, re-imaging/re-creating it with new ISE OS version, presumably with the same IP...