Sops can natively handle .env files. All you need to apply them to your process is a small wrapper script that sources the decrypted file before invoking your command.

FWIW, I looked into it myself too, and found e.g. this direnv setup:

https://github.com/direnv/direnv/wiki/Sops