Sounds risky. What if (I mean, when) there&#x27;s another critical vuln, you need to update, but unstable has moved on so the libssl&#x2F;openssl package deps are unsatisfiable on stable (for example, depending on unstable-only libc6?). Or the ABI breaks all reverse dependencies. You might have to end up upgrading to unstable to get a consistent system, but then you might have broken your own (web-)apps with a too new&#x2F;different base system... Not to mention you&#x27;re on unstable, which have had fun bugs in the past like accepting empty passwords for pam&#x2F;ssh logins(!)