Copying the answer provided by Giles at Can I allow a non-root user to log in when /etc/nologin exists?
If your system uses PAM, the login denial when /etc/nologin exists is triggered by the pam_nologin module.
You can skip the pam_nologin invocation for users matching certain criteria with pam_succeed_if. For example, if you want to allow users in the adm group to log in on a text console even if /etc/nologin exists, add the following line to /etc/pam.d/login just before the line with auth requisite pam_nologin.so:
auth [default=ignore success=1] pam_succeed_if.so quiet user ingroup adm
I added: Also note that if your system has an '/etc/pam.d/sshd' configuration file, you will need to add the same auth ignore line to it if you wish to login early via ssh.
Got hit by this when I did an oldoldstable upgrade to buster. It was quite disconcerting when I suddenly got the Go-Away message.
/run/nologin
with cron on reboot helps you?