## Sensitive-field key rotation

1. Keep the old key under `encryption.previous_keys.<old-version>`.
2. Set a new `encryption.current_key_version` and `encryption.aes_key`, then restart GoChat. New writes immediately use the new key; reads accept both.
3. Back up PostgreSQL, then run `cd backend && GOCHAT_ENV=prod go run ./cmd/rotate_secrets`.
4. Verify normal channel, webhook and integration traffic. Remove the old key only after every application and worker instance runs the new version.

The rotation command includes WhatsApp `provider_config` together with the channel access and webhook credentials.

Configuration rollback: restore the previous key version/key as current while retaining the new key in `previous_keys`, then restart all instances. The schema rollback does not narrow ciphertext-bearing columns. Rolling back to a binary that predates encrypted-field support requires restoring the pre-rotation database backup; that binary cannot decrypt ciphertext.