Comment by bingo-bongo

Just remember: never use Environment= for secrets, since they are visible to all users on the system.

(Use EnvironmentFile= instead)