A pure way to manage secrets?

I use agenix for managing some secrets on my nixos-configs. Agenix deploys the unencrypted secrets in the live system, so the secrets cannot be accesed when evaluating the nixos config.

Do you know any way or hack to have secrets inside of nix expressions?

It would be great if that solution would be pure and compatible with nix flakes.

Thanks :)