WP Update with Hardening

Hi,

in my setup, I usually follow the file permission guidelines on hardening-wordpress

This means, only the wp-content folder is writable by the webserver/PHP, all other files are just writable by the SSH/SFTP user and the PHP process can read them.

This is good for daily life, plugins or malicious code cannot access wordpress core files to write to them.

Nevertheless, for a core update write permissions are needed, so I just run a
chown -R www-data /var/www/web01.
Then I do the update, and I run a
chown -R web01 /var/www/web01
chmod -R g+w /var/www/web01/wp-content
afterwards.

This gets annoying having more and more sites to manage. Is there any hook I can use to write my own plugin which just issues those commands before/after the wordpress update?

Or is there any other idea how you handle WP core updates with hardened file permissions?

Cheers,
Andy