This works until you consider regular security vulnerability patching (which we have compliance/contractual obligations for).