You put the service account token on the filesystem and then have it removed from the filesystem after loading it. then it lives inside a process, where it is

You put the service account token on the filesystem and then have it removed from the filesystem after loading it. then it lives inside a process, where it is still recoverable by a determined adversary who attempts to obtain root and can inspect process memory, but you can further protect that by encrypting it in memory with an ephemeral key (which also should not be at a predictable location).