When a cert-manager Keystore Runs Behind a Password Change

cert-manager v1.21.2's API reference: "The keystore file will be updated immediately." After a password change, the keystores opened only with the old password throughout our 30-minute window.