When resolving an expression, keep resolving until the output of the resolution matches the input.

Use case:

${sys.prop.with.host.specific.value}

resolves to

${VAULT::xxxxx}

which resolves to

thesecret

Basically, the main mechanism for customizing domain-level configs on a per-host basis is to use expressions and use different values on each host. But this breaks down when a vault expression is added to the mix.