diff --git a/crates/relicario-cli/src/commands/org.rs b/crates/relicario-cli/src/commands/org.rs
index 6b8951c..9076eeb 100644
--- a/crates/relicario-cli/src/commands/org.rs
+++ b/crates/relicario-cli/src/commands/org.rs
@@ -376,7 +376,7 @@ pub fn run_rotate_key(dir: &Path) -> Result<()> {
         let wrapped = wrap_org_key(&new_org_key, &member.ed25519_pubkey)
             .with_context(|| format!("wrap key for {}", member.display_name))?;
         let key_path = vault.member_key_path(&member.member_id);
-        fs::write(&key_path, &wrapped)
+        crate::org_session::atomic_write(&key_path, &wrapped)
             .with_context(|| format!("write key for {}", member.display_name))?;
         staged_paths.push(format!("keys/{}.enc", member.member_id.as_str()));
     }