Nix has a decent solution here, i.e. turn the document into a nix derivation.

  with import <nixpkgs> {};
  
  pkgs.runCommand "cv.pdf" rec {
    src = ./cv.tex;
    bin = with pkgs.texlive; combine {
      inherit scheme-medium collection-latexrecommended collection-fontsextra
              moderncv etoolbox;
    };
    buildInputs = [ bin ];
    allowSubstitutes = false;
  } ''
    ln -s $src cv.tex
    latexmk -pdf cv.tex
    mkdir $out
    mv *pdf $out/
  ''

These days I'd probably use flakes to pin down the latex version.