We do this with some of our published images. RedHat complains because our images aren't 'based on UBI', which would add dozens or hundreds of CVEs.