A cloud engineer is reviewing an infrastructure-as-code template that provisions a managed database. During a code review, a colleague notices that the database administrator password is written in plaintext directly in the template file, which is committed to a shared Git repository. The team needs to remediate this before the next automated deployment while keeping the pipeline fully automated. What is the BEST approach to handle the credential going forward?