Put it in a container with a build step and lock down versions. That's what I did. Then you can choose what to update, audit code, etc.

Whatever agent will be more than capable of wiring that up.