I use dotbot as well, after having used fresh for many years. It took me a while to unwind the shell logic I’d build into fresh but I prefer dotbots yaml config.

I have a strict no secrets policy and they get laid down manually on any system that needs them.