There's probably a way you can just set it and forget it with overlayfs.

OpenWRT solved the problem of updates via immutable firmware image flashing while maintaining customizations 15 years ago using it.