Over the last couple of months I did 7 upgrades on my security.
I always had basic security in place (a Ledger hardware wallet) but felt it was time to do some upgrades. So if you are coming from that setup and consider to upgrade, this is for you.

My initial setup was basically two wallets: a hot Metamask wallet to mint and a hardware wallet to store and trade - I now consistently use a TAP (Three Address Protocol), which was popularised by Punk6529.
Now I have a vault (no allowances, no nothing), a transaction wallet and a hot minting wallet.

I migrated my vault to a SAFE smart contract wallet (coming from a Ledger). The SAFE requires multiple signatures, one of which coming from both Ledger and Trezor devices.

I switched my transaction wallet from a Ledger to a Trezor as Trezor supports SSSS. The seed phrase is now distributed across multiple shards, where you need more than just one to generate the private keys. Thus even if there would be an issue with one location, keys would be safe. The Trezor Safe 3 is a good choice that comes with USB-C and SSSS. For redundancy I always have more than one hardware wallet set up with the same seed phrase

I moved the seed phrases / shards on metal coming from paper. Black Seed Inc has a good solution that is both usable and affordable. Transferring took only some minutes and now they are fire proof.

Everyone hates Metamask. So do I. I moved finally to Rabby as my go to wallet. Is comes with a better UI/UX, transaction simulation (like what really happens when you sign), better token detection and much more. It works everywhere, where Metamask works.
I will admit, that I still sometimes use Metamask, e.g. for custom chains or other non-trivial stuff.

I did not make the leap to a dedicated crypto mac, but I changed from Chrome to Brave browser. Brave is based on Chrome, but comes with better privacy and some more crypto native features like IPFS support and a wallet.

I had two factor authentication everywhere enabled but used Auth app. To get rid of that vector I bough two YubiKeys. I went for the YubiKey 5C NFC with USB-C and NFC, so it works with my phone as well. I protected especially my CEX accounts with that. It sucks a lot when late night degening, but the additional security is worth it.