diff --git a/app/audit_logger.py b/app/audit_logger.py
index 81911ed..58c337b 100644
--- a/app/audit_logger.py
+++ b/app/audit_logger.py
@@ -351,6 +351,15 @@ def log_key_rename(username, old_name, new_name, ip_address):
     )
 
 
+def log_key_replace(username, key_name, success, ip_address):
+    status = "SUCCESS" if success else "FAILED"
+    audit_logger.info(
+        f"KEY_REPLACE_{status} | user={_sanitize_log_value(username)} | "
+        f"key={_sanitize_log_value(key_name)} | "
+        f"ip={_sanitize_log_value(ip_address)}"
+    )
+
+
 def log_key_delete(username, key_name, ip_address):
     audit_logger.info(
         f"KEY_DELETE | user={_sanitize_log_value(username)} | "
diff --git a/app/key_encryption.py b/app/key_encryption.py
index 0b55e70..c5c8ae5 100644
--- a/app/key_encryption.py
+++ b/app/key_encryption.py
@@ -388,3 +388,50 @@ def write_key_content(
             error_type=type(e).__name__,
         )
         return False
+
+
+@_serialized_key_operation
+def replace_key_content(
+        user_id: str, key_path: str, key_content: str, *,
+        allowed_root: Path = None) -> bool:
+    """Replace an existing encrypted key and restore its bytes on failure."""
+    path = Path(key_path)
+    try:
+        encrypted = encrypt_key_content(str(user_id), key_content)
+        with _key_file_lock(
+                path, allowed_root=allowed_root) as operation_path:
+            original = operation_path.read_bytes()
+            try:
+                atomic_write_bytes(operation_path, encrypted, mode=0o600)
+                stored = operation_path.read_bytes()
+                verified = decrypt_key_content(
+                    str(user_id), stored
+                ).encode('utf-8')
+                if not hmac.compare_digest(
+                    verified,
+                    key_content.encode('utf-8'),
+                ):
+                    raise ValueError('SSH key replacement verification failed')
+            except Exception as exc:
+                try:
+                    _restore_plaintext(operation_path, original)
+                except Exception as rollback_error:
+                    raise RuntimeError(
+                        'SSH key replacement rollback failed'
+                    ) from rollback_error
+                log_error(
+                    "Failed to replace encrypted key",
+                    user_id=user_id,
+                    error_type=type(exc).__name__,
+                )
+                return False
+        return True
+    except RuntimeError:
+        raise
+    except Exception as exc:
+        log_error(
+            "Failed to replace encrypted key",
+            user_id=user_id,
+            error_type=type(exc).__name__,
+        )
+        return False
diff --git a/app/key_manager.py b/app/key_manager.py
index 28cf8bc..5d2c406 100644
--- a/app/key_manager.py
+++ b/app/key_manager.py
@@ -316,6 +316,69 @@ def rename_key(user_id, key_id, new_name):
     return None, "Key not found"
 
 
+def replace_key(user_id, key_id, key_content):
+    """Atomically replace one owned key while preserving its stable identity."""
+    if not isinstance(key_id, str) or not key_id:
+        return None, "Key not found"
+    if not isinstance(key_content, str) or not key_content:
+        return None, "Invalid key content"
+
+    try:
+        with storage_lock(f'keys:{user_id}'):
+            keys = _load_keys_with_lock_held(user_id)
+            key = next((item for item in keys if item['id'] == key_id), None)
+            if key is None:
+                return None, "Key not found"
+
+            try:
+                replacement_type = identify_private_key(key_content)
+            except paramiko.PasswordRequiredException:
+                return None, "Passphrase-encrypted private keys are not supported"
+            except UnsupportedPrivateKeyError as exc:
+                return None, str(exc)
+            except paramiko.SSHException:
+                return None, "Invalid key format"
+
+            keys_dir = get_user_keys_dir(user_id)
+            if not keys_dir:
+                return None, "Key not found"
+            key_path = _safe_key_path(keys_dir, key['filename'])
+            if not _path_entry_exists(key_path):
+                return None, "Key file not found"
+            stored_content = key_encryption.read_key_content(
+                str(user_id),
+                str(key_path),
+                migrate_legacy=False,
+                allowed_root=keys_dir,
+            )
+            stored_type = identify_private_key(stored_content)
+            if stored_type != key['key_type']:
+                return None, "Stored key metadata does not match key content"
+            if replacement_type != stored_type:
+                return None, (
+                    "Replacement key must use the same key type "
+                    f"({stored_type})"
+                )
+            if not key_encryption.replace_key_content(
+                str(user_id),
+                str(key_path),
+                key_content,
+                allowed_root=keys_dir,
+            ):
+                return None, "Failed to replace key"
+            return {**key, 'usable': True}, None
+    except StorageCorruptionError:
+        raise
+    except Exception as exc:
+        log_error(
+            "Error replacing key",
+            user_id=user_id,
+            key_id=key_id,
+            exception_type=type(exc).__name__,
+        )
+        return None, "Failed to replace key"
+
+
 def _remove_key_after_metadata_failure(user_id, key_id, key_path):
     """Best-effort rollback when the encrypted key has no metadata entry."""
     try:
diff --git a/app/socket_events.py b/app/socket_events.py
index 62cda6f..6724953 100644
--- a/app/socket_events.py
+++ b/app/socket_events.py
@@ -10,7 +10,8 @@
 from .audit_logger import (log_info, log_warning, log_error, log_debug,
                               log_ssh_connection, log_ssh_disconnect,
                               log_file_upload, log_file_download,
-                              log_key_upload, log_key_rename, log_key_delete,
+                              log_key_upload, log_key_rename, log_key_replace,
+                              log_key_delete,
                               log_tailscale_ssh_usage)
 from .tailscale_ssh import (
     profile_is_authorized_for_launch,
@@ -912,6 +913,56 @@ def handle_rename_key(data, current_user=None):
     except Exception:
         return _key_mutation_error('Failed to rename key')
 
+
+@socketio.on('replace_key')
+@socket_login_required
+def handle_replace_key(data, current_user=None):
+    """Replace one owned SSH key without changing its stable identity."""
+    try:
+        data = data if isinstance(data, dict) else {}
+        key_id = data.get('key_id')
+        key_content = data.get('key_content')
+        if (
+            not isinstance(key_id, str)
+            or not key_id
+            or not isinstance(key_content, str)
+            or not key_content
+        ):
+            return _key_mutation_error('Key ID and key content required')
+        if len(key_content) > 64 * 1024:
+            return _key_mutation_error(
+                'Key content too large (max 64KB)'
+            )
+
+        key, error = key_manager.replace_key(
+            current_user.id,
+            key_id,
+            key_content,
+        )
+        if error:
+            log_key_replace(
+                current_user.username,
+                key_id,
+                False,
+                request.remote_addr,
+            )
+            return _key_mutation_error(error)
+
+        log_key_replace(
+            current_user.username,
+            key['name'],
+            True,
+            request.remote_addr,
+        )
+        payload = {'success': True, 'key': key}
+        emit('key_replaced', payload)
+        handle_list_keys(current_user=current_user)
+        return payload
+    except StorageCorruptionError as error:
+        return _emit_storage_error(error, current_user)
+    except Exception:
+        return _key_mutation_error('Failed to replace key')
+
 @socketio.on('delete_key')
 @socket_login_required
 def handle_delete_key(data, current_user=None):
diff --git a/static/css/style.css b/static/css/style.css
index 8ab9cd4..1d8e32f 100644
--- a/static/css/style.css
+++ b/static/css/style.css
@@ -2733,6 +2733,10 @@ textarea.form-control {
     box-shadow: var(--shadow-sm);
 }
 
+.key-item.replacing {
+    flex-wrap: wrap;
+}
+
 .key-info {
     display: flex;
     flex-direction: column;
@@ -2801,6 +2805,38 @@ textarea.form-control {
     min-width: 0;
 }
 
+.key-replace-editor {
+    display: flex;
+    flex: 1 0 100%;
+    flex-direction: column;
+    gap: 10px;
+    min-width: 0;
+    padding-top: 14px;
+    border-top: 1px solid var(--border-color);
+}
+
+.key-replace-editor textarea {
+    width: 100%;
+    resize: vertical;
+    font-family: var(--font-mono, monospace);
+}
+
+.key-replace-warning {
+    margin: 0;
+    color: var(--warning-color, #f3c969);
+    line-height: 1.5;
+}
+
+.key-replace-status {
+    min-height: 1.25em;
+    color: var(--text-secondary);
+    overflow-wrap: anywhere;
+}
+
+.key-replace-status.error {
+    color: var(--error-color, #e57373);
+}
+
 .profile-inline-key-status {
     min-height: 1.25em;
     color: var(--text-secondary);
@@ -2829,6 +2865,10 @@ textarea.form-control {
         flex-direction: column;
     }
 
+    .key-replace-editor {
+        width: 100%;
+    }
+
     .key-item-actions .btn,
     .profile-inline-key-actions .btn,
     .profile-inline-key > .btn {
diff --git a/static/js/app.js b/static/js/app.js
index 894934d..eb296d2 100644
--- a/static/js/app.js
+++ b/static/js/app.js
@@ -1021,6 +1021,16 @@
         ProfileManager.upsertKeySummary(data.key);
     });
 
+    socket.on('key_replaced', (data) => {
+        ProfileManager.upsertKeySummary(data.key);
+        showNotification(
+            window.i18n
+                ? i18n.t('keys.replacedSuccess')
+                : 'SSH key replaced successfully',
+            'success',
+        );
+    });
+
     socket.on('key_deleted', () => {
         showNotification('SSH key deleted successfully', 'success');
     });
diff --git a/static/js/i18n.js b/static/js/i18n.js
index f1021d2..6e2f67a 100644
--- a/static/js/i18n.js
+++ b/static/js/i18n.js
@@ -164,6 +164,15 @@ const translations = {
         'keys.renameNamed': 'Rename {name}',
         'keys.saveName': 'Save name',
         'keys.renameFailed': 'Failed to rename key',
+        'keys.replace': 'Replace',
+        'keys.replaceNamed': 'Replace {name}',
+        'keys.replacementPrivateKey': 'Replacement private key',
+        'keys.replaceWarning': 'Install the matching public key on every target first. The replacement must be another {type} private key. Future connections using this key will switch immediately; active sessions stay connected.',
+        'keys.replaceConfirm': 'Replace stored key',
+        'keys.replacing': 'Replacing key...',
+        'keys.replaceFailed': 'Failed to replace key',
+        'keys.replacementRequired': 'Enter the replacement private key.',
+        'keys.replacedSuccess': 'SSH key replaced successfully',
 
         'files.fileTransfer': 'File Transfer',
         'files.fileManager': 'File Manager',
@@ -770,6 +779,15 @@ const translations = {
         'keys.renameNamed': 'Đổi tên {name}',
         'keys.saveName': 'Lưu tên',
         'keys.renameFailed': 'Không thể đổi tên khóa',
+        'keys.replace': 'Thay thế',
+        'keys.replaceNamed': 'Thay thế {name}',
+        'keys.replacementPrivateKey': 'Khóa riêng tư thay thế',
+        'keys.replaceWarning': 'Trước tiên, hãy cài đặt khóa công khai tương ứng trên mọi máy đích. Khóa thay thế phải là một khóa riêng tư {type} khác. Các kết nối mới sẽ chuyển sang khóa này ngay lập tức; các phiên đang mở vẫn được giữ nguyên.',
+        'keys.replaceConfirm': 'Thay thế khóa đã lưu',
+        'keys.replacing': 'Đang thay thế khóa...',
+        'keys.replaceFailed': 'Không thể thay thế khóa',
+        'keys.replacementRequired': 'Nhập khóa riêng tư thay thế.',
+        'keys.replacedSuccess': 'Đã thay thế khóa SSH',
 
         'files.fileTransfer': 'Truyền tệp',
         'files.fileManager': 'Trình quản lý tệp',
@@ -1375,6 +1393,15 @@ const translations = {
         'keys.renameNamed': '{name} umbenennen',
         'keys.saveName': 'Namen speichern',
         'keys.renameFailed': 'Schlüssel konnte nicht umbenannt werden',
+        'keys.replace': 'Ersetzen',
+        'keys.replaceNamed': '{name} ersetzen',
+        'keys.replacementPrivateKey': 'Neuer privater Schlüssel',
+        'keys.replaceWarning': 'Installiere zuerst den passenden öffentlichen Schlüssel auf allen Zielsystemen. Der Ersatz muss ebenfalls ein privater Schlüssel vom Typ {type} sein. Neue Verbindungen wechseln sofort; aktive Sitzungen bleiben verbunden.',
+        'keys.replaceConfirm': 'Gespeicherten Schlüssel ersetzen',
+        'keys.replacing': 'Schlüssel wird ersetzt...',
+        'keys.replaceFailed': 'Schlüssel konnte nicht ersetzt werden',
+        'keys.replacementRequired': 'Gib den neuen privaten Schlüssel ein.',
+        'keys.replacedSuccess': 'SSH-Schlüssel erfolgreich ersetzt',
 
         'files.fileTransfer': 'Dateiübertragung',
         'files.fileManager': 'Dateimanager',
@@ -1979,6 +2006,15 @@ const translations = {
         'keys.renameNamed': 'Renommer {name}',
         'keys.saveName': 'Enregistrer le nom',
         'keys.renameFailed': 'Impossible de renommer la clé',
+        'keys.replace': 'Remplacer',
+        'keys.replaceNamed': 'Remplacer {name}',
+        'keys.replacementPrivateKey': 'Clé privée de remplacement',
+        'keys.replaceWarning': 'Installez d’abord la clé publique correspondante sur chaque cible. La clé de remplacement doit également être une clé privée de type {type}. Les nouvelles connexions basculeront immédiatement; les sessions actives resteront connectées.',
+        'keys.replaceConfirm': 'Remplacer la clé enregistrée',
+        'keys.replacing': 'Remplacement de la clé...',
+        'keys.replaceFailed': 'Impossible de remplacer la clé',
+        'keys.replacementRequired': 'Saisissez la clé privée de remplacement.',
+        'keys.replacedSuccess': 'Clé SSH remplacée',
 
         'files.fileTransfer': 'Transfert de fichiers',
         'files.fileManager': 'Gestionnaire de fichiers',
@@ -2583,6 +2619,15 @@ const translations = {
         'keys.renameNamed': 'Cambiar el nombre de {name}',
         'keys.saveName': 'Guardar nombre',
         'keys.renameFailed': 'No se pudo cambiar el nombre de la clave',
+        'keys.replace': 'Reemplazar',
+        'keys.replaceNamed': 'Reemplazar {name}',
+        'keys.replacementPrivateKey': 'Clave privada de reemplazo',
+        'keys.replaceWarning': 'Instala primero la clave pública correspondiente en cada destino. La clave de reemplazo también debe ser una clave privada de tipo {type}. Las conexiones nuevas cambiarán inmediatamente; las sesiones activas seguirán conectadas.',
+        'keys.replaceConfirm': 'Reemplazar clave guardada',
+        'keys.replacing': 'Reemplazando clave...',
+        'keys.replaceFailed': 'No se pudo reemplazar la clave',
+        'keys.replacementRequired': 'Introduce la clave privada de reemplazo.',
+        'keys.replacedSuccess': 'Clave SSH reemplazada correctamente',
 
         'files.fileTransfer': 'Transferencia de archivos',
         'files.fileManager': 'Gestor de archivos',
@@ -3187,6 +3232,15 @@ const translations = {
         'keys.renameNamed': '重命名 {name}',
         'keys.saveName': '保存名称',
         'keys.renameFailed': '无法重命名密钥',
+        'keys.replace': '替换',
+        'keys.replaceNamed': '替换 {name}',
+        'keys.replacementPrivateKey': '替换私钥',
+        'keys.replaceWarning': '请先在每个目标主机上安装匹配的公钥。替换项必须是另一个 {type} 私钥。后续连接会立即改用新密钥，当前活动会话不受影响。',
+        'keys.replaceConfirm': '替换已保存的密钥',
+        'keys.replacing': '正在替换密钥...',
+        'keys.replaceFailed': '无法替换密钥',
+        'keys.replacementRequired': '请输入替换私钥。',
+        'keys.replacedSuccess': 'SSH 密钥替换成功',
 
         'files.fileTransfer': '文件传输',
         'files.fileManager': '文件管理器',
diff --git a/static/js/profile-manager.js b/static/js/profile-manager.js
index fbf7319..a113a17 100644
--- a/static/js/profile-manager.js
+++ b/static/js/profile-manager.js
@@ -7,6 +7,10 @@ const ProfileManager = {
     editingKeyId: null,
     editingKeyName: null,
     keyRenamePending: false,
+    replacingKeyId: null,
+    replacementKeyContent: '',
+    keyReplacePending: false,
+    keyReplaceError: null,
     inlineKeyUploadPending: false,
     profileSearchQuery: '',
     organizationPending: new Set(),
@@ -83,9 +87,32 @@ const ProfileManager = {
                 const input = button.closest('.key-item')?.querySelector('.key-rename-input');
                 this.submitKeyRename(keyId, input?.value || '');
             }
+            if (button.dataset.keyAction === 'replace') this.beginKeyReplacement(keyId);
+            if (button.dataset.keyAction === 'cancel-replace') this.cancelKeyReplacement();
+            if (button.dataset.keyAction === 'confirm-replace') {
+                const input = button.closest('.key-item')?.querySelector('.key-replace-input');
+                this.submitKeyReplacement(keyId, input?.value || '');
+            }
             if (button.dataset.keyAction === 'delete') this.deleteKey(keyId);
         });
         document.getElementById('keysList')?.addEventListener('keydown', event => {
+            const replacementInput = event.target.closest('.key-replace-input');
+            if (replacementInput) {
+                if (event.key === 'Escape') {
+                    event.preventDefault();
+                    event.stopPropagation();
+                    this.cancelKeyReplacement();
+                }
+                if (event.key === 'Enter' && (event.ctrlKey || event.metaKey)) {
+                    event.preventDefault();
+                    event.stopPropagation();
+                    this.submitKeyReplacement(
+                        replacementInput.dataset.keyId,
+                        replacementInput.value,
+                    );
+                }
+                return;
+            }
             const input = event.target.closest('.key-rename-input');
             if (!input) return;
             if (event.key === 'Enter') {
@@ -100,6 +127,12 @@ const ProfileManager = {
             }
         });
         document.getElementById('keysList')?.addEventListener('input', event => {
+            const replacementInput = event.target.closest('.key-replace-input');
+            if (replacementInput?.dataset.keyId === this.replacingKeyId) {
+                this.replacementKeyContent = replacementInput.value;
+                this.keyReplaceError = null;
+                return;
+            }
             const input = event.target.closest('.key-rename-input');
             if (input?.dataset.keyId === this.editingKeyId) {
                 this.editingKeyName = input.value;
@@ -376,9 +409,11 @@ const ProfileManager = {
         }
 
         container.replaceChildren();
-        this.keys.forEach(key => {
+        this.keys.forEach((key, index) => {
             const keyItem = document.createElement('div');
             keyItem.className = 'key-item';
+            const replacing = this.replacingKeyId === key.id;
+            keyItem.classList.toggle('replacing', replacing);
 
             const keyInfo = document.createElement('div');
             keyInfo.className = 'key-info';
@@ -421,7 +456,9 @@ const ProfileManager = {
                 button.dataset.keyAction = action;
                 button.dataset.keyId = key.id;
                 button.textContent = label;
-                button.disabled = this.editingKeyId === key.id && this.keyRenamePending;
+                button.disabled = (
+                    this.editingKeyId === key.id && this.keyRenamePending
+                ) || (replacing && this.keyReplacePending);
                 actions.appendChild(button);
                 return button;
             };
@@ -437,6 +474,17 @@ const ProfileManager = {
                     this.t('common.cancel', 'Cancel'),
                     'btn-secondary',
                 );
+            } else if (replacing) {
+                addAction(
+                    'confirm-replace',
+                    this.t('keys.replaceConfirm', 'Replace stored key'),
+                    'btn-danger',
+                );
+                addAction(
+                    'cancel-replace',
+                    this.t('common.cancel', 'Cancel'),
+                    'btn-secondary',
+                );
             } else {
                 const renameButton = addAction(
                     'rename',
@@ -447,12 +495,67 @@ const ProfileManager = {
                     'aria-label',
                     this.t('keys.renameNamed', 'Rename {name}').replace('{name}', key.name),
                 );
+                const replaceButton = addAction(
+                    'replace',
+                    this.t('keys.replace', 'Replace'),
+                    'btn-secondary',
+                );
+                replaceButton.setAttribute(
+                    'aria-label',
+                    this.t('keys.replaceNamed', 'Replace {name}').replace('{name}', key.name),
+                );
                 addAction('delete', this.t('common.delete', 'Delete'), 'btn-danger');
             }
 
             keyItem.appendChild(keyInfo);
             keyItem.appendChild(actions);
 
+            if (replacing) {
+                const replacementEditor = document.createElement('div');
+                replacementEditor.className = 'key-replace-editor';
+                const inputId = `key-replacement-${index}`;
+                const warningId = `key-replacement-warning-${index}`;
+                const statusId = `key-replacement-status-${index}`;
+
+                const warning = document.createElement('p');
+                warning.id = warningId;
+                warning.className = 'key-replace-warning';
+                warning.textContent = this.t(
+                    'keys.replaceWarning',
+                    'Install the matching public key on every target first. The replacement must be another {type} private key. Future connections using this key will switch immediately; active sessions stay connected.',
+                ).replace('{type}', key.key_type);
+
+                const label = document.createElement('label');
+                label.htmlFor = inputId;
+                label.textContent = this.t(
+                    'keys.replacementPrivateKey',
+                    'Replacement private key',
+                );
+
+                const textarea = document.createElement('textarea');
+                textarea.id = inputId;
+                textarea.className = 'form-control key-replace-input';
+                textarea.dataset.keyId = key.id;
+                textarea.rows = 7;
+                textarea.maxLength = 64 * 1024;
+                textarea.value = this.replacementKeyContent;
+                textarea.disabled = this.keyReplacePending;
+                textarea.setAttribute('aria-describedby', `${warningId} ${statusId}`);
+
+                const status = document.createElement('div');
+                status.id = statusId;
+                status.className = 'key-replace-status';
+                status.setAttribute('role', 'status');
+                status.setAttribute('aria-live', 'polite');
+                status.classList.toggle('error', Boolean(this.keyReplaceError));
+                status.textContent = this.keyReplacePending
+                    ? this.t('keys.replacing', 'Replacing key...')
+                    : (this.keyReplaceError || '');
+
+                replacementEditor.append(warning, label, textarea, status);
+                keyItem.appendChild(replacementEditor);
+            }
+
             container.appendChild(keyItem);
         });
 
@@ -461,6 +564,11 @@ const ProfileManager = {
                 `.key-rename-input[data-key-id="${CSS.escape(this.editingKeyId)}"]`
             )?.focus();
         }
+        if (this.replacingKeyId && !this.keyReplacePending) {
+            container.querySelector(
+                `.key-replace-input[data-key-id="${CSS.escape(this.replacingKeyId)}"]`
+            )?.focus();
+        }
     },
 
     selectProfile(profileId) {
@@ -1030,7 +1138,11 @@ const ProfileManager = {
     },
 
     beginKeyRename(keyId) {
-        if (this.keyRenamePending || !this.keys.some(key => key.id === keyId)) return;
+        if (
+            this.keyRenamePending
+            || this.replacingKeyId
+            || !this.keys.some(key => key.id === keyId)
+        ) return;
         this.editingKeyId = keyId;
         this.editingKeyName = this.keys.find(key => key.id === keyId).name;
         this.renderKeysList();
@@ -1069,6 +1181,64 @@ const ProfileManager = {
         });
     },
 
+    beginKeyReplacement(keyId) {
+        if (
+            this.keyReplacePending
+            || this.editingKeyId
+            || !this.keys.some(key => key.id === keyId)
+        ) return;
+        this.replacingKeyId = keyId;
+        this.replacementKeyContent = '';
+        this.keyReplaceError = null;
+        this.renderKeysList();
+    },
+
+    cancelKeyReplacement() {
+        if (this.keyReplacePending) return;
+        this.replacingKeyId = null;
+        this.replacementKeyContent = '';
+        this.keyReplaceError = null;
+        this.renderKeysList();
+    },
+
+    submitKeyReplacement(keyId, keyContent) {
+        if (
+            this.keyReplacePending
+            || keyId !== this.replacingKeyId
+            || !window.socket
+        ) return;
+        this.replacementKeyContent = keyContent;
+        if (!keyContent.trim()) {
+            this.keyReplaceError = this.t(
+                'keys.replacementRequired',
+                'Enter the replacement private key.',
+            );
+            this.renderKeysList();
+            return;
+        }
+
+        this.keyReplacePending = true;
+        this.keyReplaceError = null;
+        this.renderKeysList();
+        window.socket.emit('replace_key', {
+            key_id: keyId,
+            key_content: keyContent,
+        }, acknowledgement => {
+            this.keyReplacePending = false;
+            if (!acknowledgement?.success || !acknowledgement.key) {
+                this.keyReplaceError = acknowledgement?.error || this.t(
+                    'keys.replaceFailed', 'Failed to replace key'
+                );
+                this.renderKeysList();
+                return;
+            }
+            this.replacingKeyId = null;
+            this.replacementKeyContent = '';
+            this.keyReplaceError = null;
+            this.upsertKeySummary(acknowledgement.key);
+        });
+    },
+
     deleteKey(keyId) {
         if (confirm('Are you sure you want to delete this SSH key?')) {
             if (window.socket) {
diff --git a/templates/index.html b/templates/index.html
index 5700d5b..92a1efc 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -17,7 +17,7 @@
 
     <link rel="stylesheet" href="{{ url_for('static', filename='vendor/material-icons/material-icons.css') }}">
 
-    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}?v=10">
+    <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}?v=11">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/sftp-file-manager.css') }}">
     <link rel="stylesheet" href="{{ url_for('static', filename='css/session-workspace.css') }}?v=4">
 </head>
@@ -1149,7 +1149,7 @@ <h2 id="filePreviewTitle" data-i18n="preview.title">File Preview</h2>
     <script src="{{ url_for('static', filename='vendor/highlight/highlight.min.js') }}"></script>
     <script src="{{ url_for('static', filename='vendor/socketio/socket.io.min.js') }}"></script>
 
-    <script src="{{ url_for('static', filename='js/i18n.js') }}?v=7"></script>
+    <script src="{{ url_for('static', filename='js/i18n.js') }}?v=8"></script>
 
     <script src="{{ url_for('static', filename='js/binary-transfer-client.js') }}"></script>
     <script src="{{ url_for('static', filename='js/session-insights.js') }}?v=4"></script>
@@ -1170,7 +1170,7 @@ <h2 id="filePreviewTitle" data-i18n="preview.title">File Preview</h2>
     <script src="{{ url_for('static', filename='js/session-manager.js') }}?v=6"></script>
     <script src="{{ url_for('static', filename='js/account-workspace-pulse.js') }}?v=1"></script>
     <script src="{{ url_for('static', filename='js/broadcast-input.js') }}?v=2"></script>
-    <script src="{{ url_for('static', filename='js/profile-manager.js') }}?v=9"></script>
+    <script src="{{ url_for('static', filename='js/profile-manager.js') }}?v=10"></script>
     <script src="{{ url_for('static', filename='js/jump-host-manager.js') }}?v=4"></script>
     <script src="{{ url_for('static', filename='js/command-library.js') }}?v=3"></script>
     <script src="{{ url_for('static', filename='js/command-set-manager.js') }}?v=2"></script>
@@ -1179,7 +1179,7 @@ <h2 id="filePreviewTitle" data-i18n="preview.title">File Preview</h2>
     <script src="{{ url_for('static', filename='js/file-transfer.js') }}?v=2"></script>
     <script src="{{ url_for('static', filename='js/browser-filesystem.js') }}?v=2"></script>
     <script src="{{ url_for('static', filename='js/sftp-file-manager.js') }}?v=3"></script>
-    <script src="{{ url_for('static', filename='js/app.js') }}?v=10"></script>
+    <script src="{{ url_for('static', filename='js/app.js') }}?v=11"></script>
     <script>
         const flashedMessages = {{ get_flashed_messages(with_categories=true) | tojson }};
         flashedMessages.forEach(([category, message]) => {
diff --git a/tests/e2e/profile-launcher.spec.js b/tests/e2e/profile-launcher.spec.js
index 54f8b2d..b6178f9 100644
--- a/tests/e2e/profile-launcher.spec.js
+++ b/tests/e2e/profile-launcher.spec.js
@@ -411,6 +411,46 @@ test('SSH key rename supports click, Enter, cancel, and Escape', async ({ page }
     await expect(keyList).toContainText('E2E usable key');
 });
 
+test('SSH key replacement warns and preserves a failed draft', async ({ page }) => {
+    await openKeyManagement(page);
+    const keyList = page.locator('#keysList');
+    let keyItem = keyList.locator('.key-item').filter({ hasText: 'E2E usable key' });
+    await keyItem.locator('[data-key-action="replace"]').click();
+    keyItem = keyList.locator('.key-item').filter({ hasText: 'E2E usable key' });
+
+    await expect(keyItem.locator('.key-replace-warning')).toBeVisible();
+    await expect(keyItem.locator('.key-replace-warning')).toContainText(
+        'public key',
+    );
+    await page.evaluate(() => {
+        const originalEmit = window.socket.emit.bind(window.socket);
+        window.__keyReplaceOriginalEmit = originalEmit;
+        window.socket.emit = function wrappedEmit(event, ...args) {
+            if (event !== 'replace_key') return originalEmit(event, ...args);
+            const acknowledgement = typeof args.at(-1) === 'function'
+                ? args.at(-1)
+                : null;
+            queueMicrotask(() => acknowledgement?.({
+                success: false,
+                error: 'E2E intercepted key replacement',
+            }));
+            return window.socket;
+        };
+    });
+    await keyItem.locator('.key-replace-input').fill('Preserved replacement draft');
+    await keyItem.locator('[data-key-action="confirm-replace"]').click();
+    await expect(keyItem.locator('.key-replace-input')).toHaveValue(
+        'Preserved replacement draft',
+    );
+    await expect(keyItem.locator('[data-key-action="confirm-replace"]')).toBeEnabled();
+    await page.evaluate(() => {
+        window.socket.emit = window.__keyReplaceOriginalEmit;
+        delete window.__keyReplaceOriginalEmit;
+    });
+    await keyItem.locator('[data-key-action="cancel-replace"]').click();
+    await expect(keyItem.locator('.key-replace-input')).toHaveCount(0);
+});
+
 test('referenced commands and command sets cannot be deleted', async ({ page }) => {
     await page.locator('#commandLibraryBtn').click();
     await expect(page.locator('#commandWorkspaceModal')).toHaveClass(/show/);
diff --git a/tests/js/profile-manager.test.js b/tests/js/profile-manager.test.js
index c5fa958..d354130 100644
--- a/tests/js/profile-manager.test.js
+++ b/tests/js/profile-manager.test.js
@@ -15,6 +15,7 @@ function loadProfileManager() {
     vm.runInContext(source, context);
 
     const manager = context.window.ProfileManager;
+    manager.__testWindow = context.window;
     manager.setKeys = function setKeys(keys) {
         this.keys = keys;
     };
@@ -40,6 +41,68 @@ test('partial key mutation replies preserve transient usability', () => {
     assert.equal(manager.keys[0].usable, true);
 });
 
+test('failed key replacement preserves private-key draft for retry', () => {
+    const manager = loadProfileManager();
+    manager.keys = [{
+        id: 'key-1',
+        name: 'Production key',
+        key_type: 'Ed25519',
+        usable: true,
+    }];
+    manager.replacingKeyId = 'key-1';
+    manager.renderKeysList = () => {};
+    manager.t = (_key, fallback) => fallback;
+    let emitted = null;
+    manager.__testWindow.socket = {
+        emit(event, payload, acknowledgement) {
+            emitted = {event, payload};
+            acknowledgement({success: false, error: 'Replacement rejected'});
+        },
+    };
+
+    manager.submitKeyReplacement('key-1', 'private-key-draft');
+
+    assert.equal(emitted.event, 'replace_key');
+    assert.equal(emitted.payload.key_id, 'key-1');
+    assert.equal(emitted.payload.key_content, 'private-key-draft');
+    assert.equal(manager.replacingKeyId, 'key-1');
+    assert.equal(manager.replacementKeyContent, 'private-key-draft');
+    assert.equal(manager.keyReplacePending, false);
+});
+
+test('successful key replacement clears draft and merges safe summary', () => {
+    const manager = loadProfileManager();
+    manager.keys = [{
+        id: 'key-1',
+        name: 'Production key',
+        key_type: 'Ed25519',
+        usable: true,
+    }];
+    manager.replacingKeyId = 'key-1';
+    manager.renderKeysList = () => {};
+    manager.t = (_key, fallback) => fallback;
+    manager.__testWindow.socket = {
+        emit(_event, _payload, acknowledgement) {
+            acknowledgement({
+                success: true,
+                key: {
+                    id: 'key-1',
+                    name: 'Production key',
+                    key_type: 'Ed25519',
+                    usable: true,
+                },
+            });
+        },
+    };
+
+    manager.submitKeyReplacement('key-1', 'replacement-private-key');
+
+    assert.equal(manager.replacingKeyId, null);
+    assert.equal(manager.replacementKeyContent, '');
+    assert.equal(manager.keyReplacePending, false);
+    assert.equal(manager.keys[0].usable, true);
+});
+
 test('favorite acknowledgement replaces cleared organization fields', () => {
     const manager = loadProfileManager();
     manager.profiles = [{
diff --git a/tests/test_key_encryption.py b/tests/test_key_encryption.py
index 0b5aa69..a7a442e 100644
--- a/tests/test_key_encryption.py
+++ b/tests/test_key_encryption.py
@@ -307,6 +307,51 @@ def replace_then_fail(path, payload, mode=0o600):
             assert open(key_path, 'rb').read() == original
             assert sorted(os.listdir(tmpdir)) == ['legacy.pem']
 
+    def test_key_replacement_post_replace_failure_restores_ciphertext(
+            self, monkeypatch, rsa_private_key_pem,
+            rsa_openssh_private_key_pem):
+        from app import key_encryption
+        from app.storage_utils import atomic_write_bytes as real_atomic_write
+
+        user_id = 'replacement-rollback'
+        original = key_encryption.encrypt_key_content(
+            user_id, rsa_private_key_pem
+        )
+        errors = []
+
+        with tempfile.TemporaryDirectory() as tmpdir:
+            key_path = Path(tmpdir) / 'stored.pem'
+            key_path.write_bytes(original)
+
+            def replace_then_fail(path, payload, mode=0o600):
+                real_atomic_write(path, payload, mode)
+                raise OSError('private post-replace failure detail')
+
+            monkeypatch.setattr(
+                key_encryption, 'atomic_write_bytes', replace_then_fail
+            )
+            monkeypatch.setattr(
+                key_encryption,
+                'log_error',
+                lambda message, **fields: errors.append((message, fields)),
+            )
+
+            replaced = key_encryption.replace_key_content(
+                user_id,
+                str(key_path),
+                rsa_openssh_private_key_pem,
+                allowed_root=Path(tmpdir),
+            )
+
+            assert replaced is False
+            assert key_path.read_bytes() == original
+            assert sorted(os.listdir(tmpdir)) == ['stored.pem']
+            assert errors == [(
+                'Failed to replace encrypted key',
+                {'user_id': user_id, 'error_type': 'OSError'},
+            )]
+            assert 'private post-replace failure detail' not in repr(errors)
+
     def test_failed_readback_verification_restores_plaintext(
             self, monkeypatch, ecdsa_private_key_pem):
         from app import key_encryption
diff --git a/tests/test_key_management_ui.py b/tests/test_key_management_ui.py
index 989e20e..2dd5585 100644
--- a/tests/test_key_management_ui.py
+++ b/tests/test_key_management_ui.py
@@ -5,6 +5,7 @@
 PROFILE_MANAGER = Path('static/js/profile-manager.js').read_text(encoding='utf-8')
 APP = Path('static/js/app.js').read_text(encoding='utf-8')
 STYLE = Path('static/css/style.css').read_text(encoding='utf-8')
+I18N = Path('static/js/i18n.js').read_text(encoding='utf-8')
 
 
 def test_profile_editor_contains_accessible_inline_key_uploader():
@@ -32,18 +33,25 @@ def test_key_mutations_use_acknowledgements_and_preserve_local_state():
         'beginKeyRename(keyId)',
         'cancelKeyRename()',
         'submitKeyRename(keyId, name)',
+        'beginKeyReplacement(keyId)',
+        'cancelKeyReplacement()',
+        'submitKeyReplacement(keyId, keyContent)',
         'upsertKeySummary(summary)',
     ):
         assert signature in PROFILE_MANAGER
 
     assert "window.socket.emit('upload_key'" in PROFILE_MANAGER
     assert "window.socket.emit('rename_key'" in PROFILE_MANAGER
+    assert "window.socket.emit('replace_key'" in PROFILE_MANAGER
     assert 'this.upsertKeySummary(acknowledgement.key)' in PROFILE_MANAGER
     assert 'profileEditorKeySelect' in PROFILE_MANAGER
     assert 'editingKeyId' in PROFILE_MANAGER
     assert 'editingKeyName' in PROFILE_MANAGER
     assert 'keyRenamePending' in PROFILE_MANAGER
     assert 'inlineKeyUploadPending' in PROFILE_MANAGER
+    assert 'replacingKeyId' in PROFILE_MANAGER
+    assert 'replacementKeyContent' in PROFILE_MANAGER
+    assert 'keyReplacePending' in PROFILE_MANAGER
 
 
 def test_failed_key_rename_preserves_the_submitted_draft():
@@ -64,10 +72,41 @@ def test_key_list_uses_delegated_actions_and_safe_text_rendering():
     assert "'rename'," in PROFILE_MANAGER
     assert "'save-rename'," in PROFILE_MANAGER
     assert "'cancel-rename'," in PROFILE_MANAGER
+    assert "'replace'," in PROFILE_MANAGER
+    assert "'confirm-replace'," in PROFILE_MANAGER
+    assert "'cancel-replace'," in PROFILE_MANAGER
     assert 'nameStrong.textContent = key.name' in PROFILE_MANAGER
     assert 'innerHTML = key.name' not in PROFILE_MANAGER
 
 
+def test_key_replacement_ui_is_accessible_warns_and_keeps_secrets_out_of_markup():
+    for fragment in (
+        "replacementEditor.className = 'key-replace-editor'",
+        "textarea.className = 'form-control key-replace-input'",
+        "status.setAttribute('role', 'status')",
+        "status.setAttribute('aria-live', 'polite')",
+        "warning.id = warningId",
+        "textarea.setAttribute('aria-describedby', `${warningId} ${statusId}`)",
+        "warning.textContent = this.t(",
+        "label.textContent = this.t(",
+    ):
+        assert fragment in PROFILE_MANAGER
+    assert 'replacementEditor.innerHTML' not in PROFILE_MANAGER
+    assert "'keys.replaceWarning'" in PROFILE_MANAGER
+    assert I18N.count("'keys.replaceWarning':") == 6
+    assert I18N.count("'keys.replaceConfirm':") == 6
+    assert I18N.count("'keys.replaceFailed':") == 6
+
+
+def test_key_replacement_event_updates_ui_and_asset_version():
+    assert "socket.on('key_replaced'" in APP
+    assert 'ProfileManager.upsertKeySummary(data.key)' in APP
+    assert "filename='js/profile-manager.js') }}?v=10" in TEMPLATE
+    assert "filename='js/i18n.js') }}?v=8" in TEMPLATE
+    assert "filename='js/app.js') }}?v=11" in TEMPLATE
+    assert "filename='css/style.css') }}?v=11" in TEMPLATE
+
+
 def test_socket_events_refresh_key_ui_without_resetting_profile_editor():
     assert "socket.on('key_renamed'" in APP
     assert 'ProfileManager.upsertKeySummary(data.key)' in APP
@@ -80,6 +119,9 @@ def test_inline_key_controls_are_responsive():
         '.profile-inline-key',
         '.key-item-actions',
         '.key-rename-editor',
+        '.key-replace-editor',
+        '.key-replace-warning',
+        '.key-replace-status.error',
         '.profile-inline-key-status.error',
     ):
         assert selector in STYLE
diff --git a/tests/test_key_manager.py b/tests/test_key_manager.py
index daa7d98..fa482ca 100644
--- a/tests/test_key_manager.py
+++ b/tests/test_key_manager.py
@@ -181,6 +181,176 @@ def test_rename_key_preserves_corrupt_metadata(app):
         assert metadata_path.read_bytes() == before
 
 
+def test_replace_key_preserves_identity_metadata_and_references(
+        app, rsa_private_key_pem, rsa_openssh_private_key_pem):
+    from app import key_encryption, key_manager, profile_manager
+
+    user_id = create_user(app, 'replace-owner')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'Rotating key', rsa_private_key_pem
+        )
+        assert error is None
+        profile, error = profile_manager.add_profile(
+            user_id,
+            'Production',
+            'prod.example.com',
+            22,
+            'operator',
+            'key',
+            key_id=key['id'],
+        )
+        assert error is None
+        key_path = Path(key_manager.get_key_path(user_id, key['id']))
+        metadata_path = key_manager.get_user_keys_file(user_id)
+        encrypted_before = key_path.read_bytes()
+        metadata_before = metadata_path.read_bytes()
+
+        replaced, error = key_manager.replace_key(
+            user_id, key['id'], rsa_openssh_private_key_pem
+        )
+
+        assert error is None
+        assert replaced == {**key, 'usable': True}
+        assert metadata_path.read_bytes() == metadata_before
+        assert key_path.read_bytes() != encrypted_before
+        assert key_encryption.is_encrypted(key_path.read_bytes()) is True
+        content, read_error = key_manager.read_key_content(
+            user_id, key['id']
+        )
+        assert read_error is None
+        assert content == rsa_openssh_private_key_pem
+        assert profile_manager.load_profiles(user_id)[0]['id'] == profile['id']
+        assert profile_manager.load_profiles(user_id)[0]['key_id'] == key['id']
+
+
+def test_replace_key_rejects_unknown_and_cross_user_ids(
+        app, rsa_private_key_pem, rsa_openssh_private_key_pem):
+    from app import key_manager
+
+    owner_id = create_user(app, 'replace-real-owner')
+    other_id = create_user(app, 'replace-other-user')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            owner_id, 'Owned key', rsa_private_key_pem
+        )
+        assert error is None
+        key_path = Path(key_manager.get_key_path(owner_id, key['id']))
+        before = key_path.read_bytes()
+
+        for user_id, key_id in (
+            (owner_id, 'missing-key'),
+            (other_id, key['id']),
+        ):
+            replaced, error = key_manager.replace_key(
+                user_id, key_id, rsa_openssh_private_key_pem
+            )
+            assert replaced is None
+            assert error == 'Key not found'
+
+        assert key_path.read_bytes() == before
+
+
+@pytest.mark.parametrize('replacement', [None, 7, '', 'not a private key'])
+def test_replace_key_rejects_invalid_content_without_writing(
+        app, rsa_private_key_pem, replacement):
+    from app import key_manager
+
+    user_id = create_user(app, 'replace-invalid')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'Original', rsa_private_key_pem
+        )
+        assert error is None
+        key_path = Path(key_manager.get_key_path(user_id, key['id']))
+        before = key_path.read_bytes()
+
+        replaced, error = key_manager.replace_key(
+            user_id, key['id'], replacement
+        )
+
+        assert replaced is None
+        assert error in {
+            'Invalid key content',
+            'Unsupported or invalid private key format',
+        }
+        assert key_path.read_bytes() == before
+
+
+def test_replace_key_rejects_different_key_type_without_writing(
+        app, rsa_private_key_pem, ed25519_private_key_pem):
+    from app import key_manager
+
+    user_id = create_user(app, 'replace-wrong-type')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'RSA key', rsa_private_key_pem
+        )
+        assert error is None
+        key_path = Path(key_manager.get_key_path(user_id, key['id']))
+        before = key_path.read_bytes()
+
+        replaced, error = key_manager.replace_key(
+            user_id, key['id'], ed25519_private_key_pem
+        )
+
+        assert replaced is None
+        assert error == 'Replacement key must use the same key type (RSA)'
+        assert key_path.read_bytes() == before
+
+
+def test_replace_key_rejects_inconsistent_legacy_type_metadata(
+        app, ed25519_private_key_pem, rsa_private_key_pem):
+    from app import key_manager
+
+    user_id = create_user(app, 'replace-stale-key-type')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'Legacy metadata', ed25519_private_key_pem
+        )
+        assert error is None
+        stale_key = {**key, 'key_type': 'RSA'}
+        assert key_manager.save_keys(user_id, [stale_key]) is True
+        key_path = Path(key_manager.get_key_path(user_id, key['id']))
+        before = key_path.read_bytes()
+
+        replaced, error = key_manager.replace_key(
+            user_id, key['id'], rsa_private_key_pem
+        )
+
+        assert replaced is None
+        assert error == 'Stored key metadata does not match key content'
+        assert key_path.read_bytes() == before
+
+
+def test_replace_key_write_failure_preserves_active_key(
+        app, monkeypatch, rsa_private_key_pem,
+        rsa_openssh_private_key_pem):
+    from app import key_manager
+
+    user_id = create_user(app, 'replace-write-failure')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'Original', rsa_private_key_pem
+        )
+        assert error is None
+        key_path = Path(key_manager.get_key_path(user_id, key['id']))
+        before = key_path.read_bytes()
+        monkeypatch.setattr(
+            key_manager.key_encryption,
+            'replace_key_content',
+            lambda *_args, **_kwargs: False,
+        )
+
+        replaced, error = key_manager.replace_key(
+            user_id, key['id'], rsa_openssh_private_key_pem
+        )
+
+        assert replaced is None
+        assert error == 'Failed to replace key'
+        assert key_path.read_bytes() == before
+
+
 @pytest.mark.parametrize(
     ('fixture_name', 'expected'),
     [
diff --git a/tests/test_key_socket_events.py b/tests/test_key_socket_events.py
index 5bf28a6..9e53585 100644
--- a/tests/test_key_socket_events.py
+++ b/tests/test_key_socket_events.py
@@ -177,3 +177,150 @@ def test_key_rename_audit_sanitizes_names(monkeypatch):
     assert messages[0].startswith('KEY_RENAME | ')
     assert '\n' not in messages[0]
     assert '\r' not in messages[0]
+
+
+def test_key_replace_returns_safe_acknowledgement_event_and_audit(
+        app, monkeypatch, rsa_private_key_pem,
+        rsa_openssh_private_key_pem):
+    from app import key_manager
+    import app.socket_events as socket_events
+
+    user_id, sid = create_socket_user(app, 'key_replace_owner')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'Rotating key', rsa_private_key_pem
+        )
+        assert error is None
+
+    audits = []
+    monkeypatch.setattr(
+        socket_events,
+        'log_key_replace',
+        lambda *args: audits.append(args),
+    )
+    acknowledgement, emitted = call_socket_handler(
+        app,
+        monkeypatch,
+        socket_events.handle_replace_key,
+        sid,
+        {
+            'key_id': key['id'],
+            'key_content': rsa_openssh_private_key_pem,
+        },
+    )
+
+    assert acknowledgement == {
+        'success': True,
+        'key': {**key, 'usable': True},
+    }
+    assert ('key_replaced', acknowledgement) in emitted
+    assert any(event == 'keys_list' for event, _payload in emitted)
+    assert rsa_openssh_private_key_pem not in repr(acknowledgement)
+    assert rsa_openssh_private_key_pem not in repr(emitted)
+    assert rsa_openssh_private_key_pem not in repr(audits)
+    assert audits == [(
+        'key_replace_owner',
+        'Rotating key',
+        True,
+        None,
+    )]
+    with app.app_context():
+        content, error = key_manager.read_key_content(user_id, key['id'])
+        assert error is None
+        assert content == rsa_openssh_private_key_pem
+
+
+def test_key_replace_rejects_missing_and_oversized_content_without_secret_echo(
+        app, monkeypatch, rsa_private_key_pem):
+    from app import key_manager
+    import app.socket_events as socket_events
+
+    user_id, sid = create_socket_user(app, 'key_replace_rejected')
+    with app.app_context():
+        key, error = key_manager.save_key(
+            user_id, 'Original', rsa_private_key_pem
+        )
+        assert error is None
+
+    cases = (
+        ({'key_id': key['id']}, 'Key ID and key content required'),
+        (
+            {'key_id': key['id'], 'key_content': 's' * (64 * 1024 + 1)},
+            'Key content too large (max 64KB)',
+        ),
+    )
+    for payload, expected_error in cases:
+        acknowledgement, emitted = call_socket_handler(
+            app,
+            monkeypatch,
+            socket_events.handle_replace_key,
+            sid,
+            payload,
+        )
+        assert acknowledgement == {
+            'success': False,
+            'error': expected_error,
+        }
+        if payload.get('key_content'):
+            assert payload['key_content'] not in repr(acknowledgement)
+        assert all(event != 'key_replaced' for event, _payload in emitted)
+
+
+def test_key_replace_manager_error_is_audited_without_private_input(
+        app, monkeypatch):
+    import app.socket_events as socket_events
+
+    _user_id, sid = create_socket_user(app, 'key_replace_failed')
+    private_input = 'private-replacement-sentinel'
+    monkeypatch.setattr(
+        socket_events.key_manager,
+        'replace_key',
+        lambda *_args: (None, 'Replacement rejected'),
+    )
+    audits = []
+    monkeypatch.setattr(
+        socket_events,
+        'log_key_replace',
+        lambda *args: audits.append(args),
+    )
+
+    acknowledgement, emitted = call_socket_handler(
+        app,
+        monkeypatch,
+        socket_events.handle_replace_key,
+        sid,
+        {'key_id': 'owned-key', 'key_content': private_input},
+    )
+
+    assert acknowledgement == {
+        'success': False,
+        'error': 'Replacement rejected',
+    }
+    assert private_input not in repr(acknowledgement)
+    assert private_input not in repr(emitted)
+    assert private_input not in repr(audits)
+    assert audits == [(
+        'key_replace_failed',
+        'owned-key',
+        False,
+        None,
+    )]
+
+
+def test_key_replace_audit_sanitizes_values(monkeypatch):
+    from app import audit_logger
+
+    messages = []
+    monkeypatch.setattr(audit_logger.audit_logger, 'info', messages.append)
+
+    audit_logger.log_key_replace(
+        'admin\nforged',
+        'key\rsecret',
+        False,
+        '127.0.0.1\nforged',
+    )
+
+    assert len(messages) == 1
+    assert messages[0].startswith('KEY_REPLACE_FAILED | ')
+    assert '\n' not in messages[0]
+    assert '\r' not in messages[0]
diff --git a/tests/test_profile_launcher_ui.py b/tests/test_profile_launcher_ui.py
index 1a97e45..d83a6dc 100644
--- a/tests/test_profile_launcher_ui.py
+++ b/tests/test_profile_launcher_ui.py
@@ -24,20 +24,20 @@ def test_template_has_one_empty_pane_renderer_and_loads_launcher_utility_first()
 def test_merged_profile_frontend_assets_have_distinct_cache_versions():
     template = read('templates/index.html')
     expected_versions = {
-        "filename='css/style.css'": '?v=10',
-        "filename='js/i18n.js'": '?v=7',
+        "filename='css/style.css'": '?v=11',
+        "filename='js/i18n.js'": '?v=8',
         "filename='js/command-workspace.js'": '?v=2',
         "filename='js/command-palette-utils.js'": '?v=1',
         "filename='js/profile-launcher-utils.js'": '?v=3',
         "filename='js/connection-launcher.js'": '?v=1',
-        "filename='js/profile-manager.js'": '?v=9',
+        "filename='js/profile-manager.js'": '?v=10',
         "filename='js/session-manager.js'": '?v=6',
         "filename='js/terminal-manager.js'": '?v=4',
         "filename='js/jump-host-manager.js'": '?v=4',
         "filename='js/command-library.js'": '?v=3',
         "filename='js/command-set-manager.js'": '?v=2',
         "filename='js/session-command-launcher.js'": '?v=2',
-        "filename='js/app.js'": '?v=10',
+        "filename='js/app.js'": '?v=11',
     }
     for asset, version in expected_versions.items():
         asset_start = template.index(asset)
@@ -130,7 +130,7 @@ def test_mobile_launcher_stacks_status_below_profile_details():
 def test_profile_launcher_stylesheet_uses_current_cache_version():
     template = read('templates/index.html')
 
-    assert "filename='css/style.css') }}?v=10" in template
+    assert "filename='css/style.css') }}?v=11" in template
 
 
 def test_active_session_command_launcher_is_loaded_after_command_data_managers():