at least for now, I just make sure that any internet connection is "metered" to avoid updates + use an LTSC build + use a bunch of winhawk + openshell to make it...usable :(

ms is def at the point of major enshitification