GrapheneOS and a Pixel. Sounds exactly like what you want.
Alternatively, a Fairphone with CalyxOS.

Both are more secure and private than a stock Android phone.
GrapheneOS would be my recommendation.

I used Calyx for a year and recently switched over to Graphene. Calyx was great for the time being, as it focused more on usability, when GrapheneOS didn't even provide push notifications and was needlessly secure for my threat model.

But now, GrapheneOS is even more compatible and complete than Calyx, while more secure.
It's very barebones by default and Google services are optional and sandboxed + strongly restricted.

I would get a newer Pixel model in your case. I bought the Pixel 5 and somewhat regret it, since it hit end of support.

Or, you could buy a Fairphone. That would be more sustainable, since you can modify and repair it easily yourself, and it has a super long warranty and support.
GrapheneOS sadly does only support Pixels, but Calyx the Fairphone too.