In theory, the webhook server can [update its webhook configuration](https://docs.github.com/en/rest/repos/webhooks?apiVersion=2022-11-28#update-a-webhook-configuration-for-a-repository) via the GitHub API. So the webhook server could rotate its secret periodically, automatically, without admin involvement.