How do you read secrets directly into variables?

Hi, I am using sops-nix to manage secrets in my nixos/flakes project for my remote hosts.

I was able to make it work for services that read all their needed credentials from files (as sops-nix will place secrets on /run/secrets/... and you can access them by their config.sops.secrets."...".path field), but there are also some other services that only have a "password" field where you need to write the actual secret string somehow.

I've tried with builtins.readFile ... but it errors out that "access to absolute path '/run' is forbidden in pure evaluation mode (use '--impure' to override)".

So what is the best nix way to do this without exposing secrets?