Keycloak - injecting secrets into keycloak container on realm import

I’m running keycloak in docker, and for the local setup (and for some other envs) I import a realm json file, via the KEYCLOAK_IMPORT env variable.

This realm gets created, now I’m only wondering what’s the easiest way to inject secrets into this json file?

What I was thinking was executing a shell script on container startup that will replace placeholders within the realm json file - before keycloak starts and imports it.

Is that fine, or there is some other way?

https://www.keycloak.org/docs/latest/server_admin/index.html#_vault-administration