I stopped treating Docker secrets like ordinary configuration, and my setup instantly felt safer.