Currently, during migration process we decipher elements in payload with metadata marked as credentials type.
In fact, in all cases , the migration's developer never touch ciphered values and do not need unvaulted secrets.
Moreover, if there's a key migration for credential value (key renaming for instance), old key won't be considered as a credential so not deciphered.

Vault deciphering remains needed for action executions.