It would be cool if there was a way to adjust secret references based on profiles or something

I feel like that should be possible - have not tried. But we do something similar for auth all the time to change which provider an identity uses