Harden secret store and resolve catalog overrides (#1891)

Co-authored-by: codex <codex@users.noreply.github.com>