When you try to change the value of a sensitive environment variable, it fails.

The provider should do a replacement if the underlying API doesn't allow updating.

We have to be able to update the variable, how else do you rotate secrets?

Workaround is to manually delete the secret in the Vercel dashboard before planning/applying.