Qubes. Get a another laptop. Something old and cheap. X230 or better for some basic security tools in the chip. On that front though, learn to either disable Intel ME or cough up for someone else doing so. would recommend a Librem from Purism.
If so, get a three year warranty. I don't know about us lasting that long here but mine lasted two years before all the ports stopped working with USB going first. I sent it to them with a new NVMe and the sent me back a failure after asking me if they could wipe the drive and made me pay for the shipment. When I received it and told them about their failure, they paid for shipping the second time. Sent me someone that worked for another two years.
I quit windows two decades ago. Didn't get into comps and GNU/Linux for 5 more years. First thing i learned about comps when I built one was GNU/Linux.
It's not the software itself that I respect, but the philosophy of Richard Stallman. He is no less than our Messiah and he doesn't make a single reference to a gorram thing that ain't a tangible security concept he manifests into what makes sense.
Like I'll ever "trust" someone I don't know let alone some pedophiliac thief's OS that someone wrote and even he don't know. Despite claiming anything about its function.