Apply configuration secrets atomically

internal/config/load.go

@@ -40,13 +40,17 @@ func Load(opts LoadOptions) (Config, error) {
 		return Config{}, err
 	}
 
-	if err := loadSecrets(cfg.Secrets); err != nil {
+	secrets, err := loadSecrets(cfg.Secrets)
+	if err != nil {
 		return Config{}, err
 	}
 
 	if err := Validate(cfg); err != nil {
 		return Config{}, err
 	}
+	if err := applySecrets(secrets); err != nil {
+		return Config{}, err
+	}
 
 	return cfg, nil
 }