diff --git a/terraform/.terraform.lock.hcl b/terraform/.terraform.lock.hcl
index 5c6c05b..3588791 100644
--- a/terraform/.terraform.lock.hcl
+++ b/terraform/.terraform.lock.hcl
@@ -5,6 +5,7 @@ provider "registry.terraform.io/hashicorp/azuread" {
   version     = "2.53.1"
   constraints = "~> 2.53.1"
   hashes = [
+    "h1:0z/718jtR2TJHQQMMqi4nvd6XFPV/iA1jb/5fyAcn5o=",
     "h1:2rk36pu4YyhBVz/Mf4swYCQxaB31iPaXOiWNlqZMXbM=",
     "h1:EZNO8sEtUABuRxujQrDrW1z1QsG0dq6iLbzWtnG7Om4=",
     "zh:162916b037e5133f49298b0ffa3e7dcef7d76530a8ca738e7293373980f73c68",
@@ -28,6 +29,7 @@ provider "registry.terraform.io/hashicorp/azurerm" {
   hashes = [
     "h1:ipFQShK0j3mtJeSgSBQDR985KzwC19913+0GkiF8Sfo=",
     "h1:uuThLccbeEWYo2wpwDmlZ+TGfm7zCrwaJdw91TA3azg=",
+    "h1:vgrdy5JWGAK5N44/V75etoHIAMvXKNlMrIHTaWApehA=",
     "zh:0db8afb9278993df7e74796bdd125153b07a7045e5ca1756783a8b8cfec564f4",
     "zh:22c424fcfda13dc720caa289248c1b71b2ad20e329fd4a52cc6be7e45f795a4a",
     "zh:471a2c1d7353bc21ef28963f006d2cf5276e7885b423fc0b73f2d8ce6cde72dd",
@@ -48,6 +50,7 @@ provider "registry.terraform.io/hashicorp/google" {
   constraints = "~> 5.38.0"
   hashes = [
     "h1:5xqoIwJbuXeHvq2NVt9S783fGS05hQUHg1AnnIJ+6EI=",
+    "h1:AiZOKcqHB6RiJ54PHxDxxKtOndEwY3B6SZFLCEC3rRI=",
     "h1:b0EBaiZJws/MFU6zlo/r9R7lznLOxnN1O6xerdwsCZE=",
     "zh:0db794dfbd4d3604499f1a4011faf7aa3f4c07eace32aa238bdf0b235965259a",
     "zh:372f399f67c7e320c25e71d5a2c4c9bad6b4f9b35f7fcdc86fb5009711e34751",
@@ -63,3 +66,25 @@ provider "registry.terraform.io/hashicorp/google" {
     "zh:fa5f5d9bce05bb02ef58bead70e4b8653feb98293eb4e0d95bce58b3b1f0a943",
   ]
 }
+
+provider "registry.terraform.io/hashicorp/time" {
+  version     = "0.12.1"
+  constraints = "~> 0.12.1"
+  hashes = [
+    "h1:6BhxSYBJdBBKyuqatOGkuPKVenfx6UmLdiI13Pb3his=",
+    "h1:JzYsPugN8Fb7C4NlfLoFu7BBPuRVT2/fCOdCaxshveI=",
+    "h1:j+ED7j0ZFJ4EDx7sdna76wsiIf397toylDN0dFi6v0U=",
+    "zh:090023137df8effe8804e81c65f636dadf8f9d35b79c3afff282d39367ba44b2",
+    "zh:26f1e458358ba55f6558613f1427dcfa6ae2be5119b722d0b3adb27cd001efea",
+    "zh:272ccc73a03384b72b964918c7afeb22c2e6be22460d92b150aaf28f29a7d511",
+    "zh:438b8c74f5ed62fe921bd1078abe628a6675e44912933100ea4fa26863e340e9",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:85c8bd8eefc4afc33445de2ee7fbf33a7807bc34eb3734b8eefa4e98e4cddf38",
+    "zh:98bbe309c9ff5b2352de6a047e0ec6c7e3764b4ed3dfd370839c4be2fbfff869",
+    "zh:9c7bf8c56da1b124e0e2f3210a1915e778bab2be924481af684695b52672891e",
+    "zh:d2200f7f6ab8ecb8373cda796b864ad4867f5c255cff9d3b032f666e4c78f625",
+    "zh:d8c7926feaddfdc08d5ebb41b03445166df8c125417b28d64712dccd9feef136",
+    "zh:e2412a192fc340c61b373d6c20c9d805d7d3dee6c720c34db23c2a8ff0abd71b",
+    "zh:e6ac6bba391afe728a099df344dbd6481425b06d61697522017b8f7a59957d44",
+  ]
+}
diff --git a/terraform/entra_apps.tf b/terraform/entra_apps.tf
index 72ae713..6108435 100644
--- a/terraform/entra_apps.tf
+++ b/terraform/entra_apps.tf
@@ -16,6 +16,19 @@ resource "azuread_service_principal" "caddy" {
   }
 }
 
+# Entra ID gives client secrets a 2-year lifetime by default. Rotate the Caddy
+# secret yearly so it is replaced well before it expires; otherwise Caddy's
+# ACME DNS-01 challenge silently fails and the apt/yum TLS certificates lapse.
+# After this clock trips, `terraform apply` creates a new secret and the Ansible
+# playbook must be re-run to push it to the VM.
+resource "time_rotating" "caddy_password" {
+  rotation_days = 365
+}
+
 resource "azuread_service_principal_password" "caddy" {
   service_principal_id = azuread_service_principal.caddy.object_id
+
+  rotate_when_changed = {
+    rotation = time_rotating.caddy_password.id
+  }
 }
diff --git a/terraform/providers.tf b/terraform/providers.tf
index 0e89025..8b252fc 100644
--- a/terraform/providers.tf
+++ b/terraform/providers.tf
@@ -14,6 +14,11 @@ terraform {
       source  = "hashicorp/google"
       version = "~> 5.38.0"
     }
+
+    time = {
+      source  = "hashicorp/time"
+      version = "~> 0.12.1"
+    }
   }
 
   required_version = ">= 1.5"