The secret store every zPo process resolves credentials through: values stated in the environment, mounted files re-read when they rotate, and a mounted folder read one generation at a time, with one name served from one source.