Definitely curious if you've come up with a way to give each build a short lived vault approle somehow in any CI system.