Referring to K8s Secret from Grafana's YAML?

Grafana
1

How can a K8s Secret be referenced from Grafana’s (v10.4.0, 03f502a94d) YAML, when provisioning alerting?

I already have a working config (f.e. for datasources, dashboardProviders, etc.) which I’d like to now expand with the alerting section, but without storing secrets in plaintext:

alerting:
  contactpoints.yaml:
      secret:
        apiVersion: 1
        contactPoints:
          - orgId: 1
            name: foo
            receivers:
              - uid: bar
                type: slack
                secure_settings:
# Should `token` (below) be moved here? 
# (How) can a K8s Secret be referenced?
                  token: my-k8s-grafana-secret?
                settings:
                  recipient: devs
                  token: xxx
                  username: bot
                  # etc.

The docs merely say

Secure settings are stored encrypted in the database and you add them to secure_settings in the YAML file instead of settings.

but it’s not clear, to me at least, how to avoid exposing the secret (token above).