Scenario 30: Your team wants to migrate everyone from BCrypt to Argon2 without forcing a mass password reset across the whole user base.

Use DelegatingPasswordEncoder configured with Argon2 as the encoder for new hashes, while it can still verify existing {bcrypt}-prefixed hashes. On each successful login, check encoder.upgradeEncoding() against the stored hash; if it indicates an upgrade is available, re-hash the just-verified raw password with the new algorithm and save it — active users migrate transparently over time as they log in, with no forced reset.