diff --git a/scripts/src/platform-infra-secret-plane.ts b/scripts/src/platform-infra-secret-plane.ts
index 5fde92f0..44ec1a0d 100644
--- a/scripts/src/platform-infra-secret-plane.ts
+++ b/scripts/src/platform-infra-secret-plane.ts
@@ -926,7 +926,7 @@ printf '%s' ${shQuote(testValue)} >"$expected"
 vault_pod="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${secretPlane.vault.deploymentName},app.kubernetes.io/component=vault-backend -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/vault-pod.err" || true)"
 printf '%s' "$vault_pod" >"$tmp/vault-pod.txt"
 if [ -n "$vault_pod" ]; then
-  kubectl -n ${target.namespace} exec "$vault_pod" -- sh -lc ${shQuote(vaultPutCommand)} <"$expected" >"$tmp/vault-put.out" 2>"$tmp/vault-put.err"
+  kubectl -n ${target.namespace} exec -i "$vault_pod" -- sh -lc ${shQuote(vaultPutCommand)} <"$expected" >"$tmp/vault-put.out" 2>"$tmp/vault-put.err"
   vault_put_rc=$?
   kubectl -n ${target.namespace} exec "$vault_pod" -- sh -lc ${shQuote(vaultMetadataCommand)} >"$tmp/vault-metadata.out" 2>"$tmp/vault-metadata.err"
   vault_metadata_rc=$?
@@ -951,24 +951,40 @@ while [ "$(date +%s)" -le "$deadline" ]; do
   fi
   sleep ${secretPlane.validation.pollSeconds}
 done
+if [ "$sync_rc" -eq 0 ]; then
+  kubectl -n ${target.namespace} rollout restart deployment/${secretPlane.syncProbe.consumer.deploymentName} >"$tmp/consumer-rollout-restart.out" 2>"$tmp/consumer-rollout-restart.err"
+  consumer_rollout_restart_rc=$?
+  if [ "$consumer_rollout_restart_rc" -eq 0 ]; then
+    kubectl -n ${target.namespace} rollout status deployment/${secretPlane.syncProbe.consumer.deploymentName} --timeout=25s >"$tmp/consumer-rollout.out" 2>"$tmp/consumer-rollout.err"
+    consumer_rollout_rc=$?
+  else
+    consumer_rollout_rc=1
+    printf '%s\\n' 'consumer rollout restart failed' >"$tmp/consumer-rollout.err"
+  fi
+else
+  consumer_rollout_restart_rc=1
+  consumer_rollout_rc=1
+  printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-rollout-restart.err"
+  printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-rollout.err"
+fi
 consumer_pod="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${secretPlane.syncProbe.consumer.deploymentName},app.kubernetes.io/component=secret-consumer -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/consumer-pod.err" || true)"
 printf '%s' "$consumer_pod" >"$tmp/consumer-pod.txt"
-if [ "$sync_rc" -eq 0 ] && [ -n "$consumer_pod" ]; then
-  kubectl -n ${target.namespace} exec "$consumer_pod" -- sh -lc ${shQuote(consumerCommand)} <"$expected" >"$tmp/consumer-env.out" 2>"$tmp/consumer-env.err"
+if [ "$sync_rc" -eq 0 ] && [ "$consumer_rollout_rc" -eq 0 ] && [ -n "$consumer_pod" ]; then
+  kubectl -n ${target.namespace} exec -i "$consumer_pod" -- sh -lc ${shQuote(consumerCommand)} <"$expected" >"$tmp/consumer-env.out" 2>"$tmp/consumer-env.err"
   consumer_env_rc=$?
 else
   consumer_env_rc=1
-  if [ -z "$consumer_pod" ]; then printf '%s\\n' 'consumer pod not found' >"$tmp/consumer-env.err"; else printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-env.err"; fi
+  if [ -z "$consumer_pod" ]; then printf '%s\\n' 'consumer pod not found' >"$tmp/consumer-env.err"; elif [ "$consumer_rollout_rc" -ne 0 ]; then printf '%s\\n' 'consumer rollout not ready' >"$tmp/consumer-env.err"; else printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-env.err"; fi
 fi
 kubectl -n ${target.namespace} get secretstore ${secretPlane.syncProbe.secretStoreName} -o json >"$tmp/secretstore.json" 2>"$tmp/secretstore.err"
 secretstore_rc=$?
 kubectl -n ${target.namespace} get externalsecret ${secretPlane.syncProbe.externalSecretName} -o json >"$tmp/externalsecret.json" 2>"$tmp/externalsecret.err"
 externalsecret_rc=$?
-python3 - "$vault_put_rc" "$vault_metadata_rc" "$sync_rc" "$consumer_env_rc" "$secretstore_rc" "$externalsecret_rc" "$secret_fingerprint" "$tmp" <<'PY'
+python3 - "$vault_put_rc" "$vault_metadata_rc" "$sync_rc" "$consumer_rollout_restart_rc" "$consumer_rollout_rc" "$consumer_env_rc" "$secretstore_rc" "$externalsecret_rc" "$secret_fingerprint" "$tmp" <<'PY'
 import json, os, sys
-vault_put_rc, vault_metadata_rc, sync_rc, consumer_env_rc, secretstore_rc, externalsecret_rc = [int(value) for value in sys.argv[1:7]]
-secret_fingerprint = sys.argv[7]
-tmp = sys.argv[8]
+vault_put_rc, vault_metadata_rc, sync_rc, consumer_rollout_restart_rc, consumer_rollout_rc, consumer_env_rc, secretstore_rc, externalsecret_rc = [int(value) for value in sys.argv[1:9]]
+secret_fingerprint = sys.argv[9]
+tmp = sys.argv[10]
 def text(name, limit=3000):
     try:
         return open(os.path.join(tmp, name), encoding="utf-8", errors="replace").read()[-limit:]
@@ -983,7 +999,7 @@ def conditions(obj):
     status = (obj or {}).get("status") or {}
     return [{"type": c.get("type"), "status": c.get("status"), "reason": c.get("reason"), "message": c.get("message")} for c in status.get("conditions", [])]
 payload = {
-    "ok": vault_put_rc == 0 and vault_metadata_rc == 0 and sync_rc == 0 and consumer_env_rc == 0 and secretstore_rc == 0 and externalsecret_rc == 0,
+    "ok": vault_put_rc == 0 and vault_metadata_rc == 0 and sync_rc == 0 and consumer_rollout_restart_rc == 0 and consumer_rollout_rc == 0 and consumer_env_rc == 0 and secretstore_rc == 0 and externalsecret_rc == 0,
     "target": "${target.id}",
     "namespace": "${target.namespace}",
     "checks": {
@@ -999,6 +1015,10 @@ payload = {
             "stderrTail": text("secret.err"),
         },
         "consumerEnvInjection": {
+            "rolloutRestartExitCode": consumer_rollout_restart_rc,
+            "rolloutExitCode": consumer_rollout_rc,
+            "rolloutStdoutTail": text("consumer-rollout.out"),
+            "rolloutStderrTail": text("consumer-rollout.err"),
             "exitCode": consumer_env_rc,
             "deploymentName": "${secretPlane.syncProbe.consumer.deploymentName}",
             "pod": text("consumer-pod.txt", 200),