What I did. Provisioned the whole environment as code. Ran the agents in managed containers with auto-scaling, put load balancing in front with a controlled frontend-to-backend path, and moved every credential into managed secrets so nothing long-lived sits in the workload.