## TL;DR
Doppler updates the secret, but your service read its environment at boot and caches it; nothing short of a restart picks up the change. Restart or redeploy the service after secret changes, verify the new value is live, and automate restarts for the future.

## Steps
1. Confirm the staleness: compare the value the service reports (or behaves with) against `doppler secrets` output. Expected: Doppler has the new value, the service has the old one.
2. Restart the service: redeploy, restart the container, or bounce the process so it re-reads the environment through `doppler run` or its env file. Expected: the service boots with the current values.
3. Verify the new value is live: exercise the code path that uses the secret. Expected: behavior matches the new secret.
4. Automate the reload: wire secret changes to a redeploy (webhook, CI trigger, or operator) so the next change propagates without manual restarts. Expected: future rotations propagate automatically.
5. For secrets that must rotate without restarts, move the read to request time (fetch from Doppler or a secret manager per request) instead of boot time. Expected: no restart needed for those paths.

## When to use
- A Doppler secret changed but the app still uses the old value
- Rotation completed yet behavior did not change
- Designing secret propagation for a service

## When not to use
- Doppler CLI cannot see the project (auth or scoping issue)
- The value is wrong in Doppler itself (source-of-truth issue)

## Tool compatibility
- Doppler (`doppler run`, `doppler secrets`); container orchestrators, process managers

## Variant phrasings
### doppler run stale env vars
`doppler run` injects at process start; a long-lived process keeps the old values until restarted.

### service not picking up rotated secret
Restart after every rotation unless the app re-reads secrets at request time.

## Why it happens
Environment variables are copied into the process at exec time and never refreshed. Doppler (like every env-based injector) can only change what the next process start sees, so a running service is frozen at its boot-time values by OS design.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6n-o8-0LZ0Ssk1kg5ggSdA