How would you migrate all users from BCrypt to Argon2 without forcing a mass password reset?

You can't re-hash without the original plain-text password, so migration typically happens lazily: keep DelegatingPasswordEncoder configured with Argon2 as the default encoder for NEW hashes, but still able to verify old {bcrypt} hashes. On each successful login, check if the stored hash uses the old algorithm (upgradeEncoding()) and if so, re-hash the just-verified raw password with the new encoder and save it — over time, active users migrate transparently.