Our application reads secrets from Azure Key Vault at startup and caches them so it doesn’t make a vault request for every operation. That keeps normal traffic light, but it raises a practical question: if a secret is rotated, how quickly should the running app pick up the new value?

What caching pattern do you use for Key Vault secrets in long-running services? I’m weighing a short time-to-live against refresh-on-demand, and would like to hear how people handle rotation without creating request spikes or a window where instances use different credentials.