Strongly recommend using Bitwarden with various collections for different types of things. When someone leaves, we rotate every single password which was in a collection they had access to. It's a massive PITA, but it works /shrug.