diff --git a/terraform/restart-app.sh b/terraform/restart-app.sh
new file mode 100755
index 000000000..efe8fd5a9
--- /dev/null
+++ b/terraform/restart-app.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+set -e
+
+if [ $# -ne 1 ]; then
+  echo "Usage: $0 D|T|P"
+  exit 1
+fi
+
+ENV="$1"
+APP="AS-CDT-PUB-VIP-CALITP-$ENV-001"
+RG="RG-CDT-PUB-VIP-CALITP-$ENV-001"
+NOW=$(date --utc)
+
+az webapp config appsettings set --name "$APP" --resource-group "$RG" --settings change_me_to_refresh_secrets="$NOW"
diff --git a/terraform/secrets/file.sh b/terraform/secrets/file.sh
old mode 100644
new mode 100755
diff --git a/terraform/secrets/read.sh b/terraform/secrets/read.sh
old mode 100644
new mode 100755
diff --git a/terraform/secrets/value.sh b/terraform/secrets/value.sh
old mode 100644
new mode 100755