I can recommend a semi-rolling distro ;D wayblue has some defaults, but I have not tried it. There also is a hardened version of it under the secureblue images. Although I think the maintainer has horrible control issues, I cant deny that the product is near perfect (apart from opinionated Chromium enforcements and some hacky parts like LD_PRELOADing a different allocator) and use the kinoite variant daily.