Prefect.yaml templating to be evaluated at runtime

I would like to set environment variable of a deployment run to read value from prefect secret. But only do it in runtime.
If I specify

        job_variables:
            env: {"DB_PASSWORD":"{{ prefect.blocks.secret.enrichment--db-pwd }}","DB_USERNAME":"postgres"}

in the UI of the deployment, I get the expected result.

But if I do it in prefect.yaml, than the template is evaluated at deployment time, and it renders the password in the Job Variables section in plain text.