How to securely manage credentials in shell scripts?

I need to improve security over a set of shell scripts which have hardcoded credentials. I’m wondering what is the state of the art on this subject. I’ve read about gpg, hashicorp vault, pass command, but still wonder what you guys are doing.

I have a bunch of scripts and a bunch of sysadmins who do not need to know those credentials but should based on their username be able to use the scripts. Those scripts query specific aspects of network infrastructure up to now via ssh.