but i recommend you use

--enroll_secret_path

and save it to a file instead of futzing with env vars