I don't think this is well known - but if you have even a single other Cisco security product licence (such as a single Umbrella licence), you can use Cisco SecureX to cloud manage your AnyConnect clients. Even if you don't want to use Umbrella - you should buy a single licence (and not use it) because this feature is so good.
You can have multiple profiles, like "Test" and "Production". You can move clients between profiles via the SecureX cloud. A profile contains all the AnyConnect configurations and version to use. If you update anything, the change is pushed out to all clients automatically via the Cisco SecureX cloud - they don't need to connect via AnyConnect to get the changes.
Even if you are using AnyConnect on another Cisco platform - you should be using this.
For example, to push out the "fixed" version to all our clients, I just have to do this one change in our production profile:
One question, how do the clients know to update? I created a vpn profile and downloaded it and it doesn't feature any parameters that would tell the client. Is the installer provided somehow customized to check in with the securex cloud for update settings?