doppler secret changed but service not restarted: sync failure
Fixes services serving stale Doppler secrets by restarting or redeploying so the new values load, and setting up reload automation. It covers the env-at-boot caching behavior. Not for Doppler CLI auth issues.
TL;DR
Doppler updates the secret, but your service read its environment at boot and caches it; nothing short of a restart picks up the change. Restart or redeploy the service after secret changes, verify the new value is live, and automate restarts for the future.
Steps
- Confirm the staleness: compare the value the service reports (or behaves with) against
doppler secretsoutput. Expected: Doppler has the new value, the service has the old one. - Restart the service: redeploy, restart the container, or bounce the process so it re-reads the environment through
doppler runor its env file. Expected: the service boots with the current values. - Verify the new value is live: exercise the code path that uses the secret. Expected: behavior matches the new secret.
- Automate the reload: wire secret changes to a redeploy (webhook, CI trigger, or operator) so the next change propagates without manual restarts. Expected: future rotations propagate automatically.
- For secrets that must rotate without restarts, move the read to request time (fetch from Doppler or a secret manager per request) instead of boot time. Expected: no restart needed for those paths.
When to use
- A Doppler secret changed but the app still uses the old value
- Rotation completed yet behavior did not change
- Designing secret propagation for a service
When not to use
- Doppler CLI cannot see the project (auth or scoping issue)
- The value is wrong in Doppler itself (source-of-truth issue)
Tool compatibility
- Doppler (
doppler run,doppler secrets); container orchestrators, process managers
Variant phrasings
doppler run stale env vars
doppler run injects at process start; a long-lived process keeps the old values until restarted.
service not picking up rotated secret
Restart after every rotation unless the app re-reads secrets at request time.
Why it happens
Environment variables are copied into the process at exec time and never refreshed. Doppler (like every env-based injector) can only change what the next process start sees, so a running service is frozen at its boot-time values by OS design.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_6n-o8-0LZ0Ssk1kg5ggSdA