CXone OAuth secret rotation sequence

What’s the right sequence to rotate client secrets without dropping active sessions? I generate a new secret via the admin API, but updating the flow causes a 401 immediately.

I’ve tried swapping the credentials in the GetRESTProxy action first, but that bricks the current run. Is there a grace period or a specific endpoint to refresh the token cache before the old secret expires?