Ideally when you declare something as technical debt, you should work to stop accumulating it. If possible, use AES-256 instead of AES-128 but you don't have to drop everything to switch to 256 today or even next 6 months.