apply updates to kernel and userland without recompiling?

[Joe]

I manage a few openbsd 3.9-release firewalls and I need to update the 
OS, but I don't want to cvsup and recompile on each system.

Is there a documented/recommended way to do update a system by creating 
a tarball or package of what was upgraded?

I'm looking to apply security fixes to systems running 3.9-RELEASE. No 
custom cruft. No compiler on the firewalls either.