Change it now to .com or get stuck there for years, suffering anti spam filters, potential renewal problems and more in the meantime.

You have the .com? That's a no-brainer imo. I have a domain for a saas where the .com is squatted so I settled for .ai (and other surrounding TLDs / host permutations) and right out of the gate ran into some issues with firewall vendors in corpo environments.