An App Service custom container reads DB_PASSWORD as an app setting. The password is stored in Azure Key Vault and rotates periodically. The app must adopt new secret versions without changing its code or app-setting name. What should you configure?