There isn't really a way around it.
Run your own servers so the .env isn't shared with your hosting provider?
There is -- you can expose a UNIX socket for serving credentials and allow access to it only from a whitelist of systemd services.
Run your own servers so the .env isn't shared with your hosting provider?