Get 2 devices, set them up the same and put 1 in a cupboard.
When you make a change / update and / or the hardware fails, then you can still recover.
Personally I have a Fritz router in bridge / pass through mode, then a pfSense firewall - basically a low-ish power microATX (I think) PC - which does all my adblocking and DNS as well as reverse proxy for home assistant, etc.
Works well. But I had a SSD failure once and that was difficult to live with…