thanks @little-cartoon-10569, I was talking about pulumi stack secrets (encrypted in the stack YML file), it seems like Pulumi insists on only decrypting these during the stack deployment, and preventing me from manipulating it in code