It has been a while but I can confirm that everything works fine as long as the secret rotation is done one step at a time:
- Rotating primary secret - Deploy Pulumi - Rotate Secondary secret