I've been working with Docker Swarm secrets and kept running into one limitation: secrets are immutable.

Once a secret is created, you can't update its value. When a password, API key, or another secret changes in an external secret store, you need a way to propagate that change to Docker Swarm.

A common approach is to create a new secret with a version or hash in its name:

database_password_v1

database_password_v2