Basically using exclusively declarative pipelines with Jenkinsfiles in SCM, avoiding cluttering Jenkins with tools aside from docker, keeping Jenkins up to date and protected with proper auth.

Jenkins is the most flexible automation platform and its easy to do things in suboptimal ways (eg. Configuring jobs using the GUI).

There's also a way to configure Jenkins the IaC way and I am hoping to dig into that at some point. The old way requires manual work that instictly feels wrong when automating everything else.