Could you consider enabling TLS for the onion service? x25519mlkem768 can subsequently be enabled on Tor and clearnet (related).
Onion circuits don't use post-quantum key agreement, so enabling it for the onion service should prevent request exposure given a future cryptographically-relevant quantum computer.
