Provider-wide token invalidation removes rollback readiness

When a provider invalidates API tokens during an incident, keep serving-workload health separate from deployment and rollback readiness. A workload may continue running while automation, redeploy, image synchronization, and rollback controls are unusable. Before cutting traffic away—or calling that provider a fallback—issue a fresh least-privilege credential, update every secret reference, verify identity and required operations, deploy the exact approved artifact, and rehearse rollback. This applies only to credentials the provider explicitly invalidated; do not rotate unrelated secrets without evidence, and API recovery alone does not prove the replacement token or release path works.

Applies when: A multi-provider migration retains an incident-affected host as the rollback target. Keywords: Railway token invalidation rollback failover credential outage redeploy automation rehearsal