Can You Hide a Proxy Password from the Client Host’s Administrator?
Choose a proxy credential scope that fits the administrators controlling the host where the secret is used.
“Keep other users out of this file” and “hide the password from the people administering this server” are different requirements.
Permissions, managed credentials and redacted diagnostics help with the first. They reduce accidental disclosure through configuration, backups, command arguments and environment dumps.
For the second, ask what those administrators control. Linux capabilities and confinement can restrict particular roles. Someone able to replace the proxy client, change its startup or inspect its execution is a different adversary from an ordinary account reading a file.
A service must eventually use the credential. Encrypting it while leaving the usable decryption path under the same administrator's control does not create the missing boundary.
Give an unattended machine an appropriately scoped service credential, with separate rotation and revocation. If an operation must remain beyond that machine's administrators, put it behind a separately administered boundary. Continue protecting the local stored copy; just do not claim its permissions solve both requirements.