One other note that makes this hard to track down - some manifests also have this problem - but have no env var secret refs (so different than the linked issue)