The first step is to separate system tools from userland tools. For example if system tools depend on python then they should be using their own isolate python and not the one that gets run when a user types 'python' on the command line. This way you can upgrade /usr/bin/python to 3.12 while /sbin/python (or whatever) can be locked at 3.8 to make sure important OS tools don't break. /sbin/python is not in the path of any user and only gets upgraded as part os a major OS upgrade.