So, how do you guys handle secrets management in CI/CD?

So I just set up a new pipeline and, surprise surprise, ran into the usual secrets problem. I've tried a few ways to handle this stuff: putting secrets in environment variables, using dedicated secret managers like Vault, or even baking them right into the build artifacts (but honestly, I try to avoid that last one if I can). What do you prefer for securely getting secrets into your build and deployment steps? Are there any tricky bits I should watch out for with your go-to method?