Or for an experimental device that has reached its EOL with no support for either software or hardware.

I would just completely disable Windows Update, act as if the computer is already compromised, and only do work where security is not an issue. That's the most "reliable" way to keep it working.

Of course, hindsight something something...

having windows update running is already a compromise in some respects

I haven't run windows update in like 20 years