Read the file on startup. Bonus: you can watch the file for changes. Which means your app can pick up rotated secrets without a process restart, whereas if you

Read the file on startup. Bonus: you can watch the file for changes. Which means your app can pick up rotated secrets without a process restart, whereas if you inject secrets via the environment they're fixed for process lifetime.