Use overlapping validity: create a new secret version, deploy apps that can use the new secret, then revoke the old one. Prefer short-lived credentials where possible. Make sure apps reload secrets safely (restart/sidecar/reload hook) and monitor failures during the rollout.