I will definitely have to look at Debian, because that sounds like just the sort of approach I actually need. Both my boxes are servers, I'm not interested in having the latest versions of desktop enviroments and the like (because I only ever access them via ssh anyway).

I just want them to keep on working and get updated with critical security patches. I'm assuming Debian stable gets prompt security patches ?