Comment by wiether

Yes that's exactly what I did.

I have a docker image with a given version of Hugo and I've been using it for years now.

That's the beauty of building HTML: you don't HAVE to stay up to date to get security fixes.