You can set up a script that installs an updated web server next to the old one, tests it and switches the site to the new version. Run it on a timer every week or so. If any tests fail it either sends a message to you or tells a coding agent to fix it.

It's practically zero overhead, low maintenance (most updates are not breaking) and you get the latest version of everything. If you're worried about supply chain attacks set a minimum release age.