How to assign labels to OCI containers securely?

Help
1

Hi, I’ve been using Homepage dashboard which retrieves my Docker containers automatically if they’ve been labelled correctly. Homepage dashboard can also show container’s statistics through widgets, such as for PiHole:
https://gethomepage.dev/widgets/services/pihole/

It requires PiHole’s API key to be set in homepage.widget.key label. This is what I have so far:

virtualisation.oci-containers.containers."pihole" = {
  image = "pihole/pihole:latest";
  environmentFiles = [
    config.sops.secrets."pihole.env".path
  ];
  volumes = [
    "pihole_config:/etc/pihole:rw"
    "pihole_dnsmasq.d:/etc/dnsmasq.d:rw"
  ];
  extraOptions = [
    "--network=host"
    "--cap-add=NET_ADMIN"
  ];
  labels = {
    "homepage.description" = "DNS";
    "homepage.group" = "Services";
    "homepage.href" = "http://pi.hole/admin";
    "homepage.icon" = "pi-hole";
    "homepage.widget.type" = "pihole";
    "homepage.widget.url" = "http://pi.hole/";
    "homepage.widget.version" = "6";
    "homepage.widget.key" = "<my-pihole-api-key>";
  };
};

However, I don’t want to hardcode the API key in my NixOS config. Is there a better way I can do this?