Move passwords to a separate bundle that can be fetched from a different repository
Change PostgreSQL user password on every run to make sure that promise is fulfilled