Ask HN: WPA2 Shared Secret Rotation: How to Avoid Downtime?

Let's assume you like to rotate your WPA2 shared secret (SSID passphrase) once a year. How do you do it without downtime and with minimal fuss? Is it possible to do it without changing SSID?

Here's how I do it:

1. Start with existing SSID `wireless-net`

2. Add new virtual SSID `wireless-net-A` with new shared secret.

3. one by one update each client to the new SSID + shared secret

4. once empty, disable `wireless-net`

The two big downsides are : (1) updating clients 1-by-1 and (2) losing SSID name . Also, some routers do not support virtual SSID

Any better approach?