diff --git a/.gitea/scripts/deploy-environment.sh b/.gitea/scripts/deploy-environment.sh
index c7d49be..658bd56 100644
--- a/.gitea/scripts/deploy-environment.sh
+++ b/.gitea/scripts/deploy-environment.sh
@@ -65,6 +65,9 @@ kubectl kustomize "k8s/overlays/${DEPLOYMENT_ENVIRONMENT}" \
   | sed "s|step3-questions:latest|${API_IMAGE}|g; s|step3-web:latest|${WEB_IMAGE}|g" \
   | kubectl apply -f -
 
+# Secret and ConfigMap values are consumed as environment variables at pod startup.
+# Force a rollout so rerunning an unchanged revision still applies rotated secrets.
+kubectl rollout restart deployment/step3-api -n "${KUBE_NAMESPACE}"
 kubectl rollout status deployment/step3-api -n "${KUBE_NAMESPACE}" --timeout=240s
 kubectl get --raw "/api/v1/namespaces/${KUBE_NAMESPACE}/services/step3-api:http/proxy/readyz" >/dev/null
 kubectl rollout status deployment/step3-web -n "${KUBE_NAMESPACE}" --timeout=240s