Searching for strategies on how to react to NixPkgs / NixOS package vulnerabilities

I am exploring different options to react to vulnerabilities in packages distributed by any NixOS version. Scenario Let’s imagine we are building a distribution based on NixOS that packages a Jellyfin and Caddy installation ready for others to self host. The promise of this distribution is that others can just use it and never need to worry about config or updates except for customizing Jellyfin. Let’s also imagine that this distro self-updates every hour or so with what is defined at the dist...