The other option here is "pick an OS and when necessary install newer packages from source."

We've been doing this for a long time at my current workplace (for dev containers) and haven't run into any problems.