Upgrading to Rails 7: Where to register the cookie rotator?

When upgrading from Rails 6 to Rails 7, the new_framework_defaults_7_0.rb file instructs to register a cookie rotator to read messages using the old digest class using SHA1 (code below). Should this code be executed a single time e.g. in a one-off rake task, or executed in an initializer at each application boot? (And in the latter case should it be enclosed in an after_initialize block as suggested here?) How to figure out whether there are other places where such a migration is needed in the app besides cookies?

Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
  salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
  secret_key_base = Rails.application.secrets.secret_key_base
  key_generator = ActiveSupport::KeyGenerator.new(
    secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
  )
  key_len = ActiveSupport::MessageEncryptor.key_len
  secret = key_generator.generate_key(salt, key_len)
  cookies.rotate :encrypted, secret
end