Freelancer here trying to figure out how to transfer a domain safely for a client without breaking their email

For context Im handling a site refresh for a local business and the owner wants me to move their domain away from the random registrar they picked years ago so everything lives in one place.

The domain is tied to their main inbox, staff emails, and a couple of dns records a previous dev added that I dont fully trust. I can get the auth code and unlock it, but timing the nameserver change and keeping mx records intact while the transfer is in progress is stressing me out.

If you have done a domain move in a situation like this, did you clone all the records first and then start the transfer or something else? idk