A Vault platform team is handling Response wrapping during a production readiness review. In the scenario, a CI bootstrap process must deliver a secret_id through an untrusted ticketing handoff without exposing the value to the ticket reader. The workload runs in two regions, but only one region is in scope for the immediate fix. Which option is the best next action?