If you are on github/gitlab, renovate bot is a good option for automating dependency updates via PRs while still maintaining pinned versions in your source.

have a multi layer build system where there is version of each layer. Example

- linux base: kernel + libc + some low tooling

- jvm base: adding the JRE/JDK you need

- your application version

Chainguard, Docker Inc’s DHI etc. There’s a whole industry for this.