after some test we opted for
managing sensitive configuration files with config injection from a private repo.

below an article showing the details:

Manage Sensitive Configurations with Config Injection from Private Repositories
https://diginsight.github.io/blog/posts/20241214%20-%20Handling%20Private%20Configurations%20in%20Public%20Repositories/

hth