Use a disconnected VM (no network) to run:

Store this ISO on a dedicated, write-protected network share with a published SHA-256 checksum. Do not rely on a single copy.