I set up a new codesearch4 instance that runs on Debian Stretch instead of codesearch3's Debian Jessie. codesearch.wmflabs.org now points to codesearch4.
Once we're happy that the new instance has no regressions (~a week), we can delete the codesearch3 instance.