I would like to add as a reminder to encrypt all devices as well. Leave as little plaintext data as possible.

Veracrypt has the ability to create hidden volumes, regardless of OS.