diff --git a/crates/relicario-cli/src/commands/item_build.rs b/crates/relicario-cli/src/commands/item_build.rs
index 45ed55c..a19661f 100644
--- a/crates/relicario-cli/src/commands/item_build.rs
+++ b/crates/relicario-cli/src/commands/item_build.rs
@@ -70,8 +70,7 @@ pub(crate) fn edit_login(
     history: &mut FieldHistory,
     totp_qr: Option<PathBuf>,
 ) -> Result<()> {
-    use relicario_core::item_types::{TotpAlgorithm, TotpConfig, TotpKind};
-    use zeroize::Zeroizing;
+    use relicario_core::item_types::{TotpConfig, TotpKind};
     if let Some(v) = prompt_keep_opt("Username", l.username.as_deref())? { l.username = Some(v); }
     if let Some(v) = prompt_keep_opt("URL", l.url.as_ref().map(|u| u.as_str()))? {
         l.url = Some(url::Url::parse(&v).with_context(|| format!("invalid URL: {v}"))?);
@@ -99,12 +98,9 @@ pub(crate) fn edit_login(
 }
 
 pub(crate) fn edit_secure_note(n: &mut relicario_core::item_types::SecureNoteCore, history: &mut FieldHistory) -> Result<()> {
-    use zeroize::Zeroizing;
     if prompt_yesno("Edit body?")? {
         let old = n.body.clone();
-        eprintln!("Enter new body; end with Ctrl-D:");
-        let mut s = String::new();
-        std::io::Read::read_to_string(&mut std::io::stdin(), &mut s)?;
+        let s = resolve_secret_multiline(false, "Enter new body; end with Ctrl-D:")?;
         n.body = Zeroizing::new(s);
         push_history(history, "secure_note_body", Zeroizing::new(old.as_str().to_string()));
     }
@@ -119,7 +115,6 @@ pub(crate) fn edit_identity(i: &mut relicario_core::item_types::IdentityCore) ->
 }
 
 pub(crate) fn edit_card(c: &mut relicario_core::item_types::CardCore, history: &mut FieldHistory) -> Result<()> {
-    use zeroize::Zeroizing;
     if let Some(v) = prompt_keep_opt("Holder", c.holder.as_deref())? { c.holder = Some(v); }
     if prompt_yesno("Change card number?")? {
         let old = c.number.clone();
@@ -132,11 +127,8 @@ pub(crate) fn edit_card(c: &mut relicario_core::item_types::CardCore, history: &
 }
 
 pub(crate) fn edit_key(k: &mut relicario_core::item_types::KeyCore, history: &mut FieldHistory) -> Result<()> {
-    use zeroize::Zeroizing;
     if prompt_yesno("Replace key material?")? {
-        eprintln!("Paste new key material; end with Ctrl-D:");
-        let mut s = String::new();
-        std::io::Read::read_to_string(&mut std::io::stdin(), &mut s)?;
+        let s = resolve_secret_multiline(false, "Paste new key material; end with Ctrl-D:")?;
         let old = k.key_material.clone();
         k.key_material = Zeroizing::new(s);
         push_history(history, "key_material", Zeroizing::new(old.as_str().to_string()));
@@ -149,7 +141,6 @@ pub(crate) fn edit_document_message() {
 }
 
 pub(crate) fn edit_totp(t: &mut relicario_core::item_types::TotpCore, history: &mut FieldHistory) -> Result<()> {
-    use zeroize::Zeroizing;
     if let Some(v) = prompt_keep_opt("Issuer", t.issuer.as_deref())? { t.issuer = Some(v); }
     if let Some(v) = prompt_keep_opt("Label", t.label.as_deref())? { t.label = Some(v); }
     if prompt_yesno("Change TOTP secret?")? {
@@ -167,7 +158,7 @@ pub(crate) fn build_login(
     password: Option<String>, password_stdin: bool, password_prompt: bool,
     totp_qr: Option<PathBuf>,
 ) -> Result<Item> {
-    use relicario_core::item_types::{LoginCore, TotpAlgorithm, TotpConfig, TotpKind};
+    use relicario_core::item_types::{LoginCore, TotpConfig, TotpKind};
     let parsed_url = match url {
         Some(s) => Some(url::Url::parse(&s).with_context(|| format!("invalid URL: {s}"))?),
         None => None,
@@ -175,7 +166,7 @@ pub(crate) fn build_login(
     let password = if let Some(p) = password {
         Some(Zeroizing::new(p))
     } else if password_stdin {
-        Some(Zeroizing::new(resolve_secret_line(true, "Password")?))
+        Some(Zeroizing::new(resolve_secret_line(password_stdin, "Password")?))
     } else if password_prompt {
         Some(Zeroizing::new(crate::prompt::prompt_secret("Password: ")?))
     } else {
@@ -244,6 +235,7 @@ pub(crate) fn build_key(
     })))
 }
 
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn build_totp(
     title: String, issuer: Option<String>, label: Option<String>,
     secret: Option<String>, secret_stdin: bool, period: u32, digits: u8, algorithm: &str,