Split each env file in two on the deploy hosts, one for secrets and one for clear values. This will allow us to update them independently.
Donal McBreen