Build args end up in the image history, so they're not real secrets. Do you use BuildKit secrets, external config, or something else for values needed at build time?