reencrypting secure env vars, #537