diff --git a/registry/routing/catalog.yaml b/registry/routing/catalog.yaml
index c76ffbf..805cbba 100644
--- a/registry/routing/catalog.yaml
+++ b/registry/routing/catalog.yaml
@@ -1359,6 +1359,14 @@ entries:
     exec_capable: false
     resolvable: false
     lane: secret
+    rotation:
+      method: rotate
+      owner: audit-core
+      automatable: false
+      steps:
+        - "Overlap-first per audit-core/docs/operator-runbook.md#sender-credential-rotation: add the replacement token to the sender's tokens list, move the sender to it, then drop the predecessor."
+        - "Write the updated registry back to platform/workloads/audit-core/senders from a mode-0600 file (never a founder paste, never argv); force the ExternalSecret sync or wait for the 1h refresh, then restart audit-core."
+        - "Senders with an exact-path projection (tenant-engine) are re-seeded through their own projection lane; verify by metadata and capabilities only."
 
   - id: email-connect-transactional
     title: email-connect transactional SMTP and caller ingest token