[koolba]

And the system for deploying or retrieving secrets itself needs secrets to authenticate with the secrets manager.

Or you generate them on the fly at deployment so that they only exist ephemerally outside the deployment site.