SQL Server Patching a Mirror configuration

We're planing to have two SQL servers updated by synchronous database mirroring. This will include a third environment configured as a witness server.

For standard windows patching - what order should we patch / reboot the servers?

The order would go like this:

1. Update the secondary server (the one that is not currently serving connections)
2. After it reboots, do a controlled mirroring failover to it
3. Update the primary server (which at this point is no longer serving connections)
4. After it reboots, you can do a controlled failover back to it if you want, but you don't have to. You can leave the connections running on the secondary box.