docker compose smb bind password

Question

I've currently got the following in my docker-compose:

volumes:
  run_vol:
    driver_opts:
      type: tmpfs
      device: tmpfs
  kimai_public:
    driver_opts:
      type: cifs
      o: username=docker,password=xxxxx,vers=3.0
      device: //192.168.0.2/kimai/public
  kimai_var:
    driver_opts:
      type: cifs
      o: username=docker,password=xxxxx,vers=3.0
      device: //192.168.0.2/kimai/var

How do I get my password out of here, ideally into a docker secret?

I'm not bound to cifs, alternatives are possible.