In coldcard terms, that leaves

1. Remaining air gapped at all times

2. Generating new keys and moving your coins every few months/years depending on what you estimate 'slowly leak' to be and how many transactions you make.