What I ended up going with is adding a proc-macro = true crate to the project (which is already a bunch of crates in a trenchcoat anyway) and defining a wrapper around the macro:

// lib.rs
use proc_macro::TokenStream;

#[proc_macro]
pub fn obfuscate_from_env(input: TokenStream) -> TokenStream {
    let var_name = syn::parse_macro_input!(input as syn::LitStr).value();
    let value =
        std::env::var(&var_name).unwrap_or_else(|e| panic!("environment variable {var_name} is required: {e:?}"));

    quote::quote! {
        cryptify::encrypt_string!(#value)
    }
    .into()
}

Then I just have to call obfuscate_from_env!("NAME_VAR") and voilà!