how can I change a passphrase for a pulumi stack?

I might be wrong, but I don’t believe you can. I think you’d need to remove all of your configuration values and then readd them using a new passphrase.

well, that's unexpected

sure that it only affects the config itself

Yes. (Assuming I’m understanding you correctly.) The passphrase is used to encrypt/decrypt configuration values. But those configuration values themselves aren’t put in the state file. Though I’ll cc @microscopic-florist-22719 to keep me honest here. Since I’m not sure how the “pluggable secrets” work we did recently does or does not interact here.

The passphrase affects both configuration secrets and secrets stored in the checkpoint file.