> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fjall.io/llms.txt
> Use this file to discover all available pages before exploring further.

# fjall rollout

> Restart an application's running services so rotated secrets take effect — no build, no deploy.

## Overview

`fjall rollout` restarts an application's running ECS services in place. Tasks read their SSM secrets **when they start**, so a rotated value only reaches your application once its tasks relaunch. A rollout registers a fresh task-definition revision (with the containers unchanged) and rolls each service — no image build, no CDK deploy, typically a minute or two instead of a full deploy.

After `fjall secrets set` or `fjall secrets import`, the CLI offers to run this for you (`Apply to <app>'s running services now? (Y/n)`).

## Usage

```bash theme={null}
fjall rollout <app>
```

Before confirming, the CLI shows which services are running with stale secrets — SSM parameters modified since the service's tasks last launched:

```
Rolling out myapp (restart running services):
  api: stale secrets
      /myapp/prod/api/DATABASE_PASSWORD (modified 2026-07-06T02:41:00Z, v7)
  worker: up to date

Relaunched tasks re-resolve their secrets at start-up, so the updated values take effect.

Restart myapp's running services now? (y/N):
```

## Options

| Option                | Description                                    | Example         |
| --------------------- | ---------------------------------------------- | --------------- |
| `--service <name>`    | Restrict the rollout to a single service       | `--service api` |
| `--skip-confirmation` | Skip the confirmation prompt                   |                 |
| `-v, --verbose`       | Show detailed output                           | `-v`            |
| `--non-interactive`   | Disable prompts and the pre-confirm drift view |                 |

## What a Rollout Does (and Doesn't)

* **Does** relaunch every running task in the target services, so new tasks re-resolve their `/<app>/<cluster>/<service>/` SSM values.
* **Does** record a release (operation `restart`) with the SSM parameter versions that were applied, so the webapp's release history shows exactly what went live.
* **Doesn't** build or push an image, change your infrastructure, or pick up **new** secret keys — a new key needs a full `fjall deploy <app>` so the task definition gains the reference.

<Warning>
  Rolling out applies whatever the current SSM values are. If several people
  are editing secrets, check `fjall secrets list --app <app>` first — the
  restart picks up **all** changes, not just yours.
</Warning>

## Related Commands

* [`fjall secrets`](/cli/secrets) — set, import, and delete the values a rollout applies
* [`fjall releases`](/cli/releases) — release history and image rollback
* [`fjall deploy`](/cli/deploy) — full build-and-deploy, needed for new secret keys or code changes