The node composes again when the vault says a secret changed, so a rotated secret or credential reaches it at once (issue 1126, ADR 0547 §2)

cmd/mesh-host/nodeagent.go

@@ -814,5 +814,7 @@ func selfComposer(ctx context.Context, session *link.Session, node string, say f
 		// Its modules' own secrets, sealed by the vault to this machine's key (ADR 0550 §5).
 		Own: func(ctx context.Context, args map[string]any) (json.RawMessage, error) {
 			return session.AskVault(ctx, "own", args)
-		}})
+		},
+		// And the vault's word that a secret changed, on which it composes again (ADR 0547 §2).
+		Hear: session.Hear})
 }