According to the PHP documentation on unsupported branches
using [unsupported branches of PHP] may expose you to security vulnerabilities and bugs that have been fixed in more recent versions of PHP.
Debian 11, the current stable release, comes with PHP 7.4. which according to the PHP documentation on supported versions ceased being actively supported 6 months ago and will only be supported for security for another 5 months. I assume this means that in 5 months time, which seems like a short time in the life of a production web server, PHP 7.4 will be considered as unsupported by the official PHP organization.
What should I do in order to set up a Debian server for a secure production PHP website?
My current best idea is to set up Apache on Debian 11 and import an 'unofficial' repository from Ondřej Surý who seems to have a good reputation for producing reliable PHP packages. Then I should be able to install PHP 8 from his repository.
Another idea would be to use PHP 7.4 with Debian 11 now and upgrade to Debian 12 assuming it ships with PHP 8. That would presumably be the safest approach theoretically but in practice sounds like a lot of admin with scope for a lot of problems.
I have seen quite a lot of advice which strongly urges users not to install software from repositories that do not ship with the distro. This wiki from Debian is an example.
Are there more sensible alternatives? If so what are they? If not which of my ideas should I pursue?