actually scrap that question, I got it sorted, didn't realise the --secure flag when setting from the CLI actually encrypts the value in the YAML as well, nice!