Our credential rotation policy requires rotating long-lived credentials at least every 90 days (or immediately when someone leaves the team). Today there's no way to rotate the runner's encryption keypair without either manually updating every Building Block input that was encrypted under the old public key, or sending us your old private key for a one-off re-encryption, which we don't want to do, it breaks the guarantee that only your runner can read your secrets.

Let the runner accept an optional "previous" private key for a configurable grace period alongside its current key. During that window, the runner can decrypt inputs still encrypted under the old key, then re-encrypt them with the new public key and submit the update through the existing input-update API, so you don't need to build custom automation to touch every input by hand. After the grace period, the old key can be retired runner-side.