Copy certificates to the images

So I have rails 7.2 app which used to be deployed with Capistrano and now I am moving to kamal and for the most part the app is deployed and works fine, but there is one issue I'm trying to figure out, that is I have apple push notifications certificates and I want that to be available when I deploy the app.

how do we handle certificates when using kamal? for staging the file will be different and for production it will be different value and also .pem file is in binary format.

Once I've figured that out, I also need to copy custom SSL certificates as well to the deployed container.

what I want is that deployed container have the certificates not the image.

my current solution is to encode base64 binary data into ENV variable and then execute a file which copies that data from ENV to a file during image build. is it a good way to handle this scenario?