diff --git a/config/initializers/cookie_rotator.rb b/config/initializers/cookie_rotator.rb
index 53b40ec8f..e30746763 100644
--- a/config/initializers/cookie_rotator.rb
+++ b/config/initializers/cookie_rotator.rb
@@ -1,20 +1,24 @@
 # frozen_string_literal: true
 
-# TODO: Enable cookies rotation when new SHA256 will be enforced
-# See new_framework_defaults_7.0.rb
-# key_generator_hash_digest_class = OpenSSL::Digest::SHA256 will be
-#
-# Rails.application.config.after_initialize do
-#   Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
-#     salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
-#     secret_key_base = Rails.application.secret_key_base
+# This cookie rotator converts cookies from the old SHA1 hash (Rails 6) to SHA256 hash (Rails 7 default).
+# It should be kept enabled for approximately 1 month to ensure most users have their cookies rotated.
+# After this period, it can be safely removed.
+# Without this rotator, all users would have been signed out.
+Rails.application.config.after_initialize do
+  Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
+    authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
+    signed_cookie_salt = Rails.application.config.action_dispatch.signed_cookie_salt
+    secret_key_base = Rails.application.secret_key_base
 
-#     key_generator = ActiveSupport::KeyGenerator.new(
-#       secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
-#     )
-#     key_len = ActiveSupport::MessageEncryptor.key_len
-#     secret = key_generator.generate_key(salt, key_len)
+    key_generator = ActiveSupport::KeyGenerator.new(
+      secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1 # Rails 6 hash
+    )
+    key_len = ActiveSupport::MessageEncryptor.key_len
 
-#     cookies.rotate :encrypted, secret
-#   end
-# end
+    old_encrypted_secret = key_generator.generate_key(authenticated_encrypted_cookie_salt, key_len)
+    old_signed_secret = key_generator.generate_key(signed_cookie_salt)
+
+    cookies.rotate :encrypted, old_encrypted_secret
+    cookies.rotate :signed, old_signed_secret
+  end
+end
diff --git a/config/initializers/new_framework_defaults_7_0.rb b/config/initializers/new_framework_defaults_7_0.rb
index 389456e6a..ad3d94df8 100644
--- a/config/initializers/new_framework_defaults_7_0.rb
+++ b/config/initializers/new_framework_defaults_7_0.rb
@@ -25,7 +25,7 @@ Rails.application.config.action_view.apply_stylesheet_media_default = false
 #
 # See upgrading guide for more information on how to build a rotator.
 # https://guides.rubyonrails.org/v7.0/upgrading_ruby_on_rails.html
-# Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
+Rails.application.config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA256
 
 # Change the digest class for ActiveSupport::Digest.
 # Changing this default means that for example Etags change and