Does this help? My understanding is that would give you a reproducible way to get the same vulnerable versions, rather than an artifact with the vulnerable versions
I did one better and put Guix 1.0 in production.
It was gone within two weeks of me leaving because no one could understand what the point of it was since you could just use docker.
I tried to push guix with a group where reproducibility really does matter and has been an issue and it's typically been met with "wha but Docker..."