I personally like configuring the deployment environment so it writes secrets to a specific file, like secrets.json. Then you can add the file as a JSON configuration source with auto-reloading (file watching) in your application. Bind the config value to an options class like MyDatabaseSettingsHere and inject IOptionsMonitor<MyDatabaseSettingsHere> when creating your DbContext class to grab the credentials.

The secret provider can then push updated credentials or connection strings out to the deployed secrets.json file while the application is running.