Managed Postgres password rotation has been available in the dashboard and Machines API for a while. As of flyctl v0.4.113, you can do it from the CLI too:

fly mpg users rotate-password <CLUSTER_ID> --username <USER>

This is available for MPG v2 clusters only, including the fly-user account. The command asks for confirmation and prints the new password.

For scripts, pass --yes --json to skip confirmation and get the username and password as JSON. Both the cluster ID and --username must be specified.

The old password stops working for new connections. Existing sessions stay connected by default; add --kill-sessions to terminate that user’s open sessions after rotation.

Afterward, update any applications and DATABASE_URL secrets that use the old password. New connections using the old credentials will fail.