> Plus I'd prefer to use DNS over HTTPS instead of using unencrypted DNS.

Running unbound or a pi-hole on your network doesn't preclude that.

Your devices talks to the gateway/router/pi-hole on the network, who will then use your chosen DoH providers for upstream requests.