Maybe using a slower, stable package manager that still gets security/bug fixes, like nix.