Kustomize args field in Kubernetes deployment resource and encrypt/manage the args password for Git (ArgoCD)

Question

I have the following deployment.yaml that is managed using Git, but I have two challenges:

deployment.yaml

    apiVersion: apps/v1
    kind: Deployement
    metadata:
      name: mydeploy
    spec:
      replicas: 1
      template:
         metadata:
           labels:
             app: myapp
         spec:
           containers:
           - args:
             - --username=${USERNAME}
             - --password=${PASSWORD}

1: How do I write an overlay kustomization.yaml file that imports deployment.yaml file (base) but replaces the args so that the file should look like:

    apiVersion: apps/v1
    kind: Deployement
    metadata:
      name: mydeploy
    spec:
      replicas: 1
      template:
         metadata:
           labels:
             app: myapp
         spec:
           containers:
           - args:
             - --username=admin
             - --password=mypassword

2. If we are using GitOps (ArgoCD), secrets can be encrypted using sealed-secrets but here the password is an argument. How do we handle this password, in GitOps (ArgoCD)?