OIDC client secret is required in the config file #731

i am using the nixos module, and i store my secrets securely in a separate repository. i want to include my oidc secret like so:

sops.secrets."tranquil-env" = {
  owner = "tranquil-pds";
};
...
services.tranquil-pds = {
  environmentFiles = [ config.sops.secrets."tranquil-env".path ];
  ...
};

however, when i run nixos-rebuild:

building '/nix/store/rbqdn8m36bbh7qllwrxxh3snnhl87ng5-validated-tranquil-config.drv'...                             
validated-tranquil-config> configuration validation failed:                                                                                               
validated-tranquil-config>   - sso.oidc.client_secret is required when sso.oidc.enabled = true                        
error: builder for '/nix/store/rbqdn8m36bbh7qllwrxxh3snnhl87ng5-validated-tranquil-config.drv' failed with exit code 1;                                   
       last 2 log lines:                                                                                                                                  
       > configuration validation failed:                                                                                                                 
       >   - sso.oidc.client_secret is required when sso.oidc.enabled = true                                                                              
       For full logs, run:                                                                                                                                
             nix log /nix/store/rbqdn8m36bbh7qllwrxxh3snnhl87ng5-validated-tranquil-config.drv 

this would mean that i need to write the client secret in my nixos configuration, which would make it publicly visible.

is it possible that the strict requirement during rebuild be removed? considering that the documentation in example.toml says that this can be set through an environment variable.