Pepper
A secret added to password hashing and kept outside the database, so a stolen hash table cannot be cracked without it.
A pepper is a secret key applied to every password, usually as HMAC(pepper, password) before the slow hash or as encryption of the hash afterwards. Unlike a salt it is not stored in the database; it lives in a KMS, HSM or secrets manager. A database-only breach (SQL injection, leaked backup) then yields hashes that cannot be attacked offline.
Rotation is the hard part. You cannot re-pepper without the plaintext password, so store a pepper version with each hash and upgrade on next login, or encrypt the hash (rather than HMAC the input) so you can re-encrypt under a new key.
It adds operational risk: lose the pepper and every user must reset their password. It is defence in depth on top of Argon2id, never a replacement for it.