Use an autounattend.xml, the mass graves, and a WinGet JSON to customise an online image.
[1]: https://schneegans.de/windows/unattend-generator/
[2]: https://learn.microsoft.com/en-gb/windows/package-manager/wi...
> to get a NEW ISO which you then install
This is not good.
Why would people put themselves through the painful process of keeping themselves safe from their own computer?
Though I do agree, if your workflow is supported by any non-NT based OS, that's probably a better option