diff --git a/images/support/gateway-registration-rotate-key.png b/images/support/gateway-registration-rotate-key.png
new file mode 100644
index 000000000..a5d168fea
Binary files /dev/null and b/images/support/gateway-registration-rotate-key.png differ
diff --git a/images/support/gateway-rotate-key-copy.png b/images/support/gateway-rotate-key-copy.png
new file mode 100644
index 000000000..f9b07e6a8
Binary files /dev/null and b/images/support/gateway-rotate-key-copy.png differ
diff --git a/images/support/gateway-rotate-key-grace-period.png b/images/support/gateway-rotate-key-grace-period.png
new file mode 100644
index 000000000..79cdd8b47
Binary files /dev/null and b/images/support/gateway-rotate-key-grace-period.png differ
diff --git a/support/rotate-credentials.mdx b/support/rotate-credentials.mdx
index b72d442d9..bf3f515b7 100644
--- a/support/rotate-credentials.mdx
+++ b/support/rotate-credentials.mdx
@@ -229,7 +229,7 @@ Create the new credential at the destination, update the Portkey configuration,
 
 For [hybrid deployments](/self-hosting/hybrid-deployments/architecture), rotate every secret in your deployment configuration:
 
-- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the Portkey control plane. Contact [Portkey support](/support/contact-us) to have it reissued, then update your deployment and restart the gateway.
+- **`PORTKEY_CLIENT_AUTH`**: the credential your gateway uses to sync with the Portkey control plane. See [Rotate the gateway client auth key](#rotate-the-gateway-client-auth-key).
 - **Log store credentials:** for example `LOG_STORE_ACCESS_KEY` and `LOG_STORE_SECRET_KEY` (S3, GCS HMAC, or Azure storage).
 - **Cache and database credentials:** Redis, and any database your deployment uses.
 - **Provider keys and other values in your environment files, Helm values, or Kubernetes secrets.**
@@ -237,6 +237,32 @@ For [hybrid deployments](/self-hosting/hybrid-deployments/architecture), rotate
 
 Redeploy the gateway after updating secrets and confirm it registers and serves requests.
 
+### Rotate the gateway client auth key
+
+<Steps>
+<Step title="Open the gateway deployment">
+Go to **Admin Settings > Gateway Registration** and open the deployment.
+<Frame>
+  <img src="/images/support/gateway-registration-rotate-key.png" alt="Gateway Registration deployment page with the Rotate Key button under Gateway Authentication" />
+</Frame>
+</Step>
+<Step title="Rotate the key">
+Under **Gateway Authentication**, click **Rotate Key**. Optionally, set a **Grace period (hours)** from 0 to 24. This is how long the previous key keeps working. Leave it empty to use the default. Click **Confirm Rotation**.
+<Frame>
+  <img src="/images/support/gateway-rotate-key-grace-period.png" alt="Rotate Key dialog with the Grace period (hours) field" />
+</Frame>
+</Step>
+<Step title="Copy the new key">
+Copy the new key and click **Done**. The key is shown only once.
+<Frame>
+  <img src="/images/support/gateway-rotate-key-copy.png" alt="New gateway auth key shown once with a copy button" />
+</Frame>
+</Step>
+<Step title="Update every deployed gateway and Data Service">
+Update `PORTKEY_CLIENT_AUTH` to the new key for every gateway and optional Data Service instance that uses this deployment. If your deployment references a secret store, update the underlying credential while preserving secret references and any other fields in the secret. Restart all consuming services so they load the new key before the grace period ends. Services still using the old key lose control-plane authentication once it expires.
+</Step>
+</Steps>
+
 ## After rotating
 
 1. **Confirm the old credentials fail.** Wait at least a few minutes for gateway sync and caches to refresh, then send a request with each old Portkey API key through every gateway, including self-hosted ones. Expect a `401`.