You actually don’t need (long-lived / hard-coded) secrets in this scenario if you use OIDC:
https://docs.github.com/en/actions/how-tos/secure-your-work/...
https://docs.github.com/en/actions/how-tos/secure-your-work/...
IE no prod access by editing the workflow definition and pushing it to a branch.