Credentials should be set with a clear maximum lifespan, with new credentials automatically generated before expiry and dual-written during the transition, and old credentials forcibly revoked after a grace period.