diff --git a/agent/proxy_sources/iron_proxy.py b/agent/proxy_sources/iron_proxy.py
--- a/agent/proxy_sources/iron_proxy.py
+++ b/agent/proxy_sources/iron_proxy.py
@@ -981,6 +981,8 @@
     reason: Optional[str] = None,
     restart: bool = True,
     operator: Optional[str] = None,
+    refresh_secrets_from_bitwarden: bool = False,
+    bitwarden_config: Optional[Dict] = None,
 ) -> RotationPlan:
     """Generate a fresh CA, archive the old one, and (optionally) restart.
 
@@ -1040,7 +1042,10 @@
     # 3. Restart the daemon if it was running and the caller wants it.
     if restart and plan.daemon_running:
         stop_proxy()
-        start_proxy()
+        start_proxy(
+            refresh_secrets_from_bitwarden=refresh_secrets_from_bitwarden,
+            bitwarden_config=bitwarden_config,
+        )
 
     # 4. Append the audit record.
     record = {
@@ -2503,24 +2508,20 @@
     return "****" + value[-4:]
 
 
-def _ca_not_after(ca_crt: Path) -> Optional[datetime]:
-    """Return the CA cert's notAfter as an aware UTC datetime, or None.
-
-    Uses ``openssl x509 -enddate`` (already a hard dep for CA generation)
-    so we don't pull in ``cryptography`` just to read one field.
-    """
+def _ca_x509_date(ca_crt: Path, flag: str) -> Optional[datetime]:
+    """Return an openssl x509 date field as an aware UTC datetime, or None."""
     if shutil.which("openssl") is None:
         return None
     try:
         res = subprocess.run(  # noqa: S603 -- openssl trusted PATH lookup
-            ["openssl", "x509", "-enddate", "-noout", "-in", str(ca_crt)],
+            ["openssl", "x509", flag, "-noout", "-in", str(ca_crt)],
             capture_output=True, text=True, timeout=10,
         )
     except (OSError, subprocess.TimeoutExpired):
         return None
     if res.returncode != 0:
         return None
-    # Output: ``notAfter=Jun  1 12:00:00 2035 GMT``
+    # Output: ``notAfter=...`` or ``notBefore=...``.
     line = res.stdout.strip()
     if "=" not in line:
         return None
@@ -2534,6 +2535,15 @@
     return None
 
 
+def _ca_not_after(ca_crt: Path) -> Optional[datetime]:
+    """Return the CA cert's notAfter as an aware UTC datetime, or None.
+
+    Uses ``openssl x509 -enddate`` (already a hard dep for CA generation)
+    so we don't pull in ``cryptography`` just to read one field.
+    """
+    return _ca_x509_date(ca_crt, "-enddate")
+
+
 def _ca_not_before(ca_crt: Path) -> Optional[datetime]:
     """Return the CA cert's notBefore as an aware UTC datetime, or None.
 
@@ -2541,29 +2551,7 @@
     ``rotation-history.jsonl`` is absent (a CA generated by ``setup`` but
     never explicitly rotated).
     """
-    if shutil.which("openssl") is None:
-        return None
-    try:
-        res = subprocess.run(  # noqa: S603 -- openssl trusted PATH lookup
-            ["openssl", "x509", "-startdate", "-noout", "-in", str(ca_crt)],
-            capture_output=True, text=True, timeout=10,
-        )
-    except (OSError, subprocess.TimeoutExpired):
-        return None
-    if res.returncode != 0:
-        return None
-    # Output: ``notBefore=Jun  1 12:00:00 2025 GMT``
-    line = res.stdout.strip()
-    if "=" not in line:
-        return None
-    raw = line.split("=", 1)[1].strip()
-    for fmt in ("%b %d %H:%M:%S %Y %Z", "%b %d %H:%M:%S %Y"):
-        try:
-            dt = datetime.strptime(raw, fmt)
-            return dt.replace(tzinfo=timezone.utc)
-        except ValueError:
-            continue
-    return None
+    return _ca_x509_date(ca_crt, "-startdate")
 
 
 def _check_ca_rotation(ca_crt: Path) -> DoctorCheck:

diff --git a/hermes_cli/proxy_cli.py b/hermes_cli/proxy_cli.py
--- a/hermes_cli/proxy_cli.py
+++ b/hermes_cli/proxy_cli.py
@@ -19,7 +19,7 @@
 import argparse
 import os
 from pathlib import Path
-from typing import List
+from typing import Dict, List, Optional, Tuple
 
 from rich.console import Console
 from rich.panel import Panel
@@ -203,6 +203,64 @@
 # ---------------------------------------------------------------------------
 
 
+def _bitwarden_start_options(cfg: Dict) -> Tuple[bool, Optional[Dict]]:
+    proxy_cfg = cfg.get("proxy") or {}
+    credential_source = proxy_cfg.get("credential_source", "env")
+    bw_cfg = (cfg.get("secrets") or {}).get("bitwarden")
+    refresh_bw = (
+        credential_source == "bitwarden"
+        and bw_cfg is not None
+        and bool(bw_cfg.get("enabled"))
+    )
+    # Pass the proxy-side allow_env_fallback opt-in through to
+    # start_proxy.  This is a deliberate, documented escape hatch: when
+    # set, the daemon silently falls back to host env if BWS is
+    # unreachable, instead of raising.  Default is strict (raise).
+    if refresh_bw and bw_cfg is not None:
+        bw_cfg = dict(bw_cfg)
+        bw_cfg["allow_env_fallback"] = bool(
+            proxy_cfg.get("allow_env_fallback", False)
+        )
+    return refresh_bw, bw_cfg
+
+
+def _bitwarden_start_ready(
+    *, refresh_bw: bool, bw_cfg: Optional[Dict], console: Console,
+) -> bool:
+    # stephenschoettler #1: when `credential_source: bitwarden`, the
+    # operator picked BWS specifically to get the rotation guarantee —
+    # silently falling back to parent-env at start_proxy time reintroduces
+    # exactly the bug class the BW mode is supposed to defeat (host env
+    # is stale / mismatched).  Pre-check at the wizard layer so we fail
+    # loud with actionable error messages BEFORE start_proxy degrades.
+    if not refresh_bw:
+        return True
+    bw_access_env = (bw_cfg or {}).get("access_token_env", "BWS_ACCESS_TOKEN")
+    if not os.environ.get(bw_access_env, "").strip():
+        console.print(
+            f"[red]✗ Refusing to start: credential_source=bitwarden but "
+            f"{bw_access_env} is not set in the environment.[/red]"
+        )
+        console.print(
+            "  Either export the access token, or run "
+            "`hermes egress setup --no-bitwarden` to switch back to "
+            "env-based credentials."
+        )
+        return False
+    if not (bw_cfg or {}).get("project_id"):
+        console.print(
+            "[red]✗ Refusing to start: credential_source=bitwarden but "
+            "secrets.bitwarden.project_id is empty.[/red]"
+        )
+        console.print(
+            "  Run `hermes secrets bitwarden setup` to configure the "
+            "project, or switch back via `hermes egress setup "
+            "--no-bitwarden`."
+        )
+        return False
+    return True
+
+
 def cmd_install(args: argparse.Namespace) -> int:
     console = Console()
     try:
@@ -567,22 +625,7 @@
     # rotation guarantee that distinguishes ``credential_source:
     # bitwarden`` from ``credential_source: env``.  Without it, rotating
     # a key in the Bitwarden web app doesn't reach the proxy.
-    credential_source = proxy_cfg.get("credential_source", "env")
-    bw_cfg = (cfg.get("secrets") or {}).get("bitwarden")
-    refresh_bw = (
-        credential_source == "bitwarden"
-        and bw_cfg is not None
-        and bool(bw_cfg.get("enabled"))
-    )
-    # Pass the proxy-side allow_env_fallback opt-in through to
-    # start_proxy.  This is a deliberate, documented escape hatch: when
-    # set, the daemon silently falls back to host env if BWS is
-    # unreachable, instead of raising.  Default is strict (raise).
-    if refresh_bw and bw_cfg is not None:
-        bw_cfg = dict(bw_cfg)
-        bw_cfg["allow_env_fallback"] = bool(
-            proxy_cfg.get("allow_env_fallback", False)
-        )
+    refresh_bw, bw_cfg = _bitwarden_start_options(cfg)
 
     # fail_on_uncovered_providers: when true, refuse to start if any
     # LLM-specific non-bearer providers (Anthropic native, Azure OpenAI,
@@ -610,36 +653,10 @@
             )
             return 1
 
-    # stephenschoettler #1: when `credential_source: bitwarden`, the
-    # operator picked BWS specifically to get the rotation guarantee —
-    # silently falling back to parent-env at start_proxy time reintroduces
-    # exactly the bug class the BW mode is supposed to defeat (host env
-    # is stale / mismatched).  Pre-check at the wizard layer so we fail
-    # loud with actionable error messages BEFORE start_proxy degrades.
-    if refresh_bw:
-        bw_access_env = (bw_cfg or {}).get("access_token_env", "BWS_ACCESS_TOKEN")
-        if not os.environ.get(bw_access_env, "").strip():
-            console.print(
-                f"[red]✗ Refusing to start: credential_source=bitwarden but "
-                f"{bw_access_env} is not set in the environment.[/red]"
-            )
-            console.print(
-                "  Either export the access token, or run "
-                "`hermes egress setup --no-bitwarden` to switch back to "
-                "env-based credentials."
-            )
-            return 1
-        if not (bw_cfg or {}).get("project_id"):
-            console.print(
-                "[red]✗ Refusing to start: credential_source=bitwarden but "
-                "secrets.bitwarden.project_id is empty.[/red]"
-            )
-            console.print(
-                "  Run `hermes secrets bitwarden setup` to configure the "
-                "project, or switch back via `hermes egress setup "
-                "--no-bitwarden`."
-            )
-            return 1
+    if not _bitwarden_start_ready(
+        refresh_bw=refresh_bw, bw_cfg=bw_cfg, console=console,
+    ):
+        return 1
 
     try:
         status = ip.start_proxy(
@@ -847,9 +864,19 @@
 
     # ------------------------------------------------------------- do it
     restart = not getattr(args, "no_restart", False)
+    cfg = load_config()
+    refresh_bw, bw_cfg = _bitwarden_start_options(cfg)
+    if restart and plan.daemon_running and not _bitwarden_start_ready(
+        refresh_bw=refresh_bw, bw_cfg=bw_cfg, console=console,
+    ):
+        return 1
     try:
-        result = ip.rotate_ca(reason=getattr(args, "reason", None),
-                              restart=restart)
+        result = ip.rotate_ca(
+            reason=getattr(args, "reason", None),
+            restart=restart,
+            refresh_secrets_from_bitwarden=refresh_bw,
+            bitwarden_config=bw_cfg,
+        )
     except Exception as exc:  # noqa: BLE001 -- user-facing error funnel
         console.print(f"[red]✗ CA rotation failed:[/red] {exc}")
         return 1

diff --git a/tests/test_iron_proxy_cli.py b/tests/test_iron_proxy_cli.py
--- a/tests/test_iron_proxy_cli.py
+++ b/tests/test_iron_proxy_cli.py
@@ -304,6 +304,77 @@
     assert captured.get("refresh_secrets_from_bitwarden") is False
 
 
+def test_cmd_rotate_ca_passes_bitwarden_refresh_when_restarting(
+    hermes_home, monkeypatch,
+):
+    from hermes_cli.config import load_config, save_config
+    cfg = load_config()
+    cfg.setdefault("proxy", {})["credential_source"] = "bitwarden"
+    cfg.setdefault("secrets", {})["bitwarden"] = {
+        "enabled": True,
+        "project_id": "test-proj-id",
+        "access_token_env": "BWS_ACCESS_TOKEN",
+    }
+    save_config(cfg)
+    monkeypatch.setenv("BWS_ACCESS_TOKEN", "bwsk-test-access-token")
+
+    plan = ip.RotationPlan(
+        ca_crt=hermes_home / "proxy" / "ca.crt",
+        ca_key=hermes_home / "proxy" / "ca.key",
+        archive_path=hermes_home / "proxy" / "ca-archive" / "ca-test.crt",
+        old_fingerprint="deadbeef" * 8,
+        daemon_running=True,
+        sandboxes=[],
+    )
+    captured: dict = {}
+
+    def fake_rotate_ca(**kw):
+        captured.update(kw)
+        plan.new_fingerprint = "feedface" * 8
+        plan.new_valid_until = "2035-06-01T12:00:00+00:00"
+        return plan
+
+    monkeypatch.setattr(ip, "plan_ca_rotation", lambda: plan)
+    monkeypatch.setattr(ip, "rotate_ca", fake_rotate_ca)
+
+    rc = proxy_cli.cmd_rotate_ca(_args())
+    assert rc == 0
+    assert captured.get("refresh_secrets_from_bitwarden") is True
+    assert captured.get("bitwarden_config") is not None
+
+
+def test_cmd_rotate_ca_refuses_when_bitwarden_token_missing(
+    hermes_home, monkeypatch,
+):
+    from hermes_cli.config import load_config, save_config
+    cfg = load_config()
+    cfg.setdefault("proxy", {})["credential_source"] = "bitwarden"
+    cfg.setdefault("secrets", {})["bitwarden"] = {
+        "enabled": True,
+        "project_id": "test-proj-id",
+        "access_token_env": "BWS_ACCESS_TOKEN",
+    }
+    save_config(cfg)
+    monkeypatch.delenv("BWS_ACCESS_TOKEN", raising=False)
+
+    plan = ip.RotationPlan(
+        ca_crt=hermes_home / "proxy" / "ca.crt",
+        ca_key=hermes_home / "proxy" / "ca.key",
+        archive_path=hermes_home / "proxy" / "ca-archive" / "ca-test.crt",
+        daemon_running=True,
+        sandboxes=[],
+    )
+    monkeypatch.setattr(ip, "plan_ca_rotation", lambda: plan)
+
+    def must_not_rotate(**kw):
+        pytest.fail("rotate_ca should not be invoked when BWS token missing")
+
+    monkeypatch.setattr(ip, "rotate_ca", must_not_rotate)
+
+    rc = proxy_cli.cmd_rotate_ca(_args())
+    assert rc == 1
+
+
 # ---------------------------------------------------------------------------
 # cmd_stop, cmd_status, cmd_disable, cmd_config
 # ---------------------------------------------------------------------------

diff --git a/tests/test_iron_proxy_rotate_ca.py b/tests/test_iron_proxy_rotate_ca.py
--- a/tests/test_iron_proxy_rotate_ca.py
+++ b/tests/test_iron_proxy_rotate_ca.py
@@ -105,6 +105,38 @@
     assert calls == ["stop", "start"]
 
 
+def test_rotate_running_daemon_preserves_bitwarden_start_options(
+    hermes_home, monkeypatch,
+):
+    """rotate-ca restarts the daemon with the same Bitwarden refresh options."""
+    _write_ca(hermes_home)
+    monkeypatch.setattr(ip, "_proxy_is_running", lambda: True)
+    monkeypatch.setattr(ip, "list_hermes_sandboxes", lambda: [])
+    calls = []
+    captured = {}
+    monkeypatch.setattr(ip, "stop_proxy", lambda: calls.append("stop"))
+
+    def fake_start_proxy(**kw):
+        calls.append("start")
+        captured.update(kw)
+
+    monkeypatch.setattr(ip, "start_proxy", fake_start_proxy)
+    bw_cfg = {"enabled": True, "project_id": "test-proj-id"}
+
+    ip.rotate_ca(
+        reason="test",
+        restart=True,
+        refresh_secrets_from_bitwarden=True,
+        bitwarden_config=bw_cfg,
+    )
+
+    assert calls == ["stop", "start"]
+    assert captured == {
+        "refresh_secrets_from_bitwarden": True,
+        "bitwarden_config": bw_cfg,
+    }
+
+
 def test_dry_run_plan_does_not_touch_filesystem(hermes_home, monkeypatch):
     """plan_ca_rotation (the dry-run engine) must not change any mtimes."""
     crt = _write_ca(hermes_home)