"Others have mentioned port-knocking which is a cool trick but not something that I typically use in an actual daily defense strategy because I'm not sure how much value it really adds."

I don't know how much it adds, but it is non-zero.

The knockd daemon is rock solid[1] and your ssh port traffic goes down to zero (other than your own use).

Port knocking has no place in security by itself but I think it's a wonderful addition to a layered defense - my favorite one, in fact.