diff --git a/scripts/src/hwlab-node.ts b/scripts/src/hwlab-node.ts
index 5674a7ee..30134eb1 100644
--- a/scripts/src/hwlab-node.ts
+++ b/scripts/src/hwlab-node.ts
@@ -4904,6 +4904,7 @@ function masterAdminApiKeySecretScript(options: NodeSecretOptions, spec: Runtime
     `action_request=${shellQuote(options.action)}`,
     `dry_run=${shellQuote(options.dryRun ? "true" : "false")}`,
     `field_manager=${shellQuote(spec.fieldManager)}`,
+    `cloud_api_deployment=${shellQuote(spec.cloudApiDeployment)}`,
     "preset=master-server-admin-api-key",
     "secret_exists_flag() { kubectl -n \"$namespace\" get secret \"$name\" >/dev/null 2>&1 && printf yes || printf no; }",
     "secret_b64_key() { kubectl -n \"$namespace\" get secret \"$name\" -o \"go-template={{ index .data \\\"$1\\\" }}\" 2>/dev/null || true; }",
@@ -4916,6 +4917,8 @@ function masterAdminApiKeySecretScript(options: NodeSecretOptions, spec: Runtime
     "action=observed",
     "mutation=false",
     "apply_exit=",
+    "rollout_restart_exit=",
+    "rollout_status_exit=",
     "if [ \"$action_request\" = ensure ]; then",
     "  missing_secret=false",
     "  [ \"$before_api_key_present\" = yes ] && [ \"$before_api_key_bytes\" -gt 0 ] || missing_secret=true",
@@ -4927,7 +4930,17 @@ function masterAdminApiKeySecretScript(options: NodeSecretOptions, spec: Runtime
     "    if [ -z \"$apply_exit\" ]; then",
     "      kubectl -n \"$namespace\" create secret generic \"$name\" --from-literal=\"$api_key_name=$api_key\" --dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager=\"$field_manager\" -f -",
     "      apply_exit=$?",
-    "      if [ \"$apply_exit\" -eq 0 ]; then action=ensured; mutation=true; else action=apply-failed; fi",
+    "      if [ \"$apply_exit\" -eq 0 ]; then",
+    "        kubectl -n \"$namespace\" rollout restart \"deployment/$cloud_api_deployment\" >/tmp/hwlab-master-admin-api-key-rollout-restart.out 2>/tmp/hwlab-master-admin-api-key-rollout-restart.err",
+    "        rollout_restart_exit=$?",
+    "        if [ \"$rollout_restart_exit\" -eq 0 ]; then",
+    "          kubectl -n \"$namespace\" rollout status \"deployment/$cloud_api_deployment\" --timeout=180s >/tmp/hwlab-master-admin-api-key-rollout-status.out 2>/tmp/hwlab-master-admin-api-key-rollout-status.err",
+    "          rollout_status_exit=$?",
+    "        fi",
+    "        if [ -n \"$rollout_restart_exit\" ] && [ \"$rollout_restart_exit\" != 0 ]; then action=rollout-restart-failed",
+    "        elif [ -n \"$rollout_status_exit\" ] && [ \"$rollout_status_exit\" != 0 ]; then action=rollout-status-failed",
+    "        else action=ensured; mutation=true; fi",
+    "      else action=apply-failed; fi",
     "    fi",
     "    api_key=",
     "  fi",
@@ -4948,8 +4961,13 @@ function masterAdminApiKeySecretScript(options: NodeSecretOptions, spec: Runtime
     "printf 'afterApiKeyPresent\\t%s\\n' \"$after_api_key_present\"",
     "printf 'afterApiKeyBytes\\t%s\\n' \"$after_api_key_bytes\"",
     "printf 'afterApiKeyPrefix\\t%s\\n' \"$after_api_key_prefix\"",
+    "printf 'cloudApiDeployment\\t%s\\n' \"$cloud_api_deployment\"",
     "printf 'applyExitCode\\t%s\\n' \"$apply_exit\"",
+    "printf 'rolloutRestartExitCode\\t%s\\n' \"$rollout_restart_exit\"",
+    "printf 'rolloutStatusExitCode\\t%s\\n' \"$rollout_status_exit\"",
     "if [ -n \"$apply_exit\" ] && [ \"$apply_exit\" != 0 ]; then exit \"$apply_exit\"; fi",
+    "if [ -n \"$rollout_restart_exit\" ] && [ \"$rollout_restart_exit\" != 0 ]; then exit \"$rollout_restart_exit\"; fi",
+    "if [ -n \"$rollout_status_exit\" ] && [ \"$rollout_status_exit\" != 0 ]; then exit \"$rollout_status_exit\"; fi",
   ].join("\n");
 }
 
@@ -5537,7 +5555,10 @@ function secretStatusFromText(text: string, commandOk: boolean, exitCode: number
       dryRun: fields.dryRun === "true",
       mutation: fields.mutation === "true",
       after: { exists: fields.afterExists === "yes", apiKey: { keyPresent: fields.afterApiKeyPresent === "yes", valueBytes: afterBytes, keyPrefix: fields.afterApiKeyPrefix || null } },
+      cloudApiDeployment: fields.cloudApiDeployment || spec.cloudApiDeployment,
       applyExitCode: numericField(fields.applyExitCode),
+      rolloutRestartExitCode: numericField(fields.rolloutRestartExitCode),
+      rolloutStatusExitCode: numericField(fields.rolloutStatusExitCode),
       exitCode,
       stderr: commandOk ? "" : stderr.trim().slice(0, 2000),
       valuesRedacted: true,