Nightly droplist download uses stale credentials after password rotation

Rotated my Nominet EPP password and updated the config, but the nightly droplist job kept using the old one from somewhere and started 401ing. Turned out it reads a separate cached credential. Confusing.