I also have an offline machine that I turn on from time to time to sync all the data and then I turn it off again.
My workhorse desktop is rarely connected to the network. It has dual monitors, and both monitors are shared by another computer that is connected to the net. So it's easy to switch either screen from workhorse to web browser or whatever. I can't cut/paste between them, but it doesn't hurt that the sneaker net is in the same physical location and even shares the same screens. I rarely need to do that anyway.
When I'm working on my laptop, I simply take what I did for the session and thumb-drive it to the workhorse later.
The workhorse desktop is my "de facto" source, so it is the only one I bother backing up.
run your machines OS booted from a non writable image.
blacklist any firmware upgrade from unhardened machines.
examining firmware for exploitive content is non trivial,and if you operate mission critical infrstructure you should have a probate machine to recieve suspect firmware for examination of its subsequent operation, before full deployment.
routerlevel, or edge machine blockade of firmware supply domains should be default with internal distribution of probated firmware until trust is established.