In theory, the webhook server can [update its webhook configuration](https://docs.github.com/en/rest/repos/webhooks?apiVersion=2022-11-28#update-a-webhook-configuration-for-a-repository) via the GitHub API. So the webhook server could rotate its secret periodically, automatically, without admin involvement.
In theory, the webhook server can update its webhook configuration via the GitHub API.
So the webhook server could rotate its secret periodically, automatically, without admin involvement.