How do I stop Okta from being the single point of failure for logins?

You're looking for concrete architectures that avoid shifting the SPOF, and honestly, the only viable ones I've seen are the ones that fully decouple. We use a separate, limited-access portal for our RevOps team that authenticates via a Google Workspace group (completely separate from our main Okta tenant). It's not for end-users, but it keeps critical functions like lead routing and list uploads running if our primary auth is down.

The key was accepting that "seamless" for all users is impossible without building another complex, fragile system. So we didn't. We built something deliberately simple and separate for a tiny set of internal functions. It's not pretty, but it works every single time we've needed it.