Or one could provide a package manager that allows user installs of software, like Nix. (Depending on the threat model, of course.)