Wait for Play to accept the new upload certificate, then replace the CI secret and verify the fingerprint under App signing. Cut over on a closed-testing build first. Keep the old keystore offline for one more release cycle in case you must re-sign a hotfix that was already uploaded with the previous key.