Freeze the compiler version and optimiser settings, run the full test suite plus fuzzing, deploy to a testnet, verify the source, transfer ownership to a multisig, and record the addresses and the exact commit.
forge test && forge script Deploy --rpc-url $BASE_SEPOLIA --broadcast --verify
Have a monitoring plan and, if the design allows, a pause switch with a documented policy for using it.