Saltstack pattern to trigger commands when a pillar changes without storing it on the host in clear-text

my_state.sls

intermediate-state-file:
  file.managed:
    - name: /etc/.intermediate_state_file
    - contents: {{ salt['hashutil.sha256_digest'](salt['pillar.get']('my_pillar')|string) }}
      
 my-cmd-1:
   cmd.wait:
     - name: "echo a command you want to run only when a my_pillar changes, but without storing it raw on the host"
     - watch:
       - file: intermediate-state-file