Thinkpad t480, they can be found pretty cheap second hand, then install libreboot. Can be upgraded with 64 GB of ram and a 4K screen.

My laptops are encrypted in case they get stolen or someone gets access to them at uni.

There is a config option that doesnt share passwords, “as marked by password managers” idk how well it works but it might block that behavior. On the PC side in clipboard configs in kde connect.

You have to scan your student card on entrance and exit but I think it gets messed up if someone gets put through by the desk staff without scanning.