The Debian-Live approach also provides some good opportunities. First and foremost, the very easy remastering makes it efficient to run with no persistent store quite often. For instance, upon remastering, I just start without the store, and the image I run is union-mounted with the persistence file and copied&compressed. Then I have to boot something else to copy the new squashfs image in place, but that's all that has to be done outside the system.
Boot the new image without persistence, create a new persistence file.
For further adaptations, the new persistence file can be mounted in an instance run under kvm, programs can be added and settings tweaked for an eventual new remastering.
Storing the series of squashfs-compressed images, one can always go back in this process if needed.

OPNsense pfSense 8-Core Atom C3758 2.2GHz 8GB DDR4 64GB SSD 8x NIC QAT AES VPN
$145.00
pfSense Firewall 16-Core Atom C3958 8GB DDR4 RAM 64GB SSD 8x 1Gbe QAT AES-NI VPN
$184.99
NETGEAR ProSafe 8-Port Gigabit VPN Firewall FVS318G NEW IN BOX
$69.99
SonicWall TZ280 Firewall 03-SSC-6933 Advanced Edition 3YR NEW SEALED
$999.99
Fortinet FortiGate 60F FG-60F P24286-03-13 Network Firewall Security Appliance
$155.75
OPNsense pfSense 16-Core Atom C3958 16GB ECC RAM 512GB SSD 8-Port QAT AES-NI VPN
$248.00
Palo Alto PA-220 Next-Gen Firewall 520-000309-00J
$40.00
OPNsense Firewall VPN QAT 8-Core Atom C3758 2.20GHz 16GB DDR4 128GB SSD 8xNIC
$175.00
Protectli Vault FW4C-0-8-120 - 4 port, Quad Core, 8GB RAM, 128GB
$180.00
Zero Trace Pen: All-in-one Tor Network Anonymous Drive + Cryptocurrency Wallet
$147.00