diff --git a/api/src/main/java/org/apache/iceberg/RotateEncryptionKeys.java b/api/src/main/java/org/apache/iceberg/RotateEncryptionKeys.java
new file mode 100644
index 000000000000..567670b79ebc
--- /dev/null
+++ b/api/src/main/java/org/apache/iceberg/RotateEncryptionKeys.java
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iceberg;
+
+import java.util.List;
+
+/**
+ * API for rotating the encryption keys of a table so that they no longer depend on a superseded
+ * version of the table master key.
+ *
+ * <p>Only the keys reachable from the current snapshot are rotated. Older snapshots keep depending
+ * on the previous keys until they are expired.
+ *
+ * <p>{@link #apply()} returns the manifests that will be replaced.
+ */
+public interface RotateEncryptionKeys extends PendingUpdate<List<ManifestFile>> {
+
+  /**
+   * An enum representing the lowest key that is regenerated. The keys above it are regenerated too,
+   * the keys directly below it are re-wrapped under the new ones, and the keys further below are
+   * left unchanged.
+   */
+  enum KeyRegenerationLevel {
+    /** Regenerate the key encryption key without committing a new snapshot. */
+    KEY_ENCRYPTION_KEY,
+    /**
+     * Regenerate the manifest list key and the keys above it, committing a new snapshot without
+     * rewriting any manifest.
+     */
+    SNAPSHOT_KEY,
+    /** Regenerate the manifest keys and the keys above them, rewriting every manifest (default). */
+    MANIFEST_KEY
+  }
+
+  /**
+   * Sets the lowest key to regenerate.
+   *
+   * <p>Consider {@link KeyRegenerationLevel#KEY_ENCRYPTION_KEY} or {@link
+   * KeyRegenerationLevel#SNAPSHOT_KEY} when rewriting every manifest is too expensive.
+   *
+   * @param level the lowest key to regenerate
+   * @return this for method chaining
+   */
+  RotateEncryptionKeys keyRegenerationLevel(KeyRegenerationLevel level);
+}
diff --git a/api/src/main/java/org/apache/iceberg/actions/ActionsProvider.java b/api/src/main/java/org/apache/iceberg/actions/ActionsProvider.java
index 3bb18d8989af..12e1a79e1093 100644
--- a/api/src/main/java/org/apache/iceberg/actions/ActionsProvider.java
+++ b/api/src/main/java/org/apache/iceberg/actions/ActionsProvider.java
@@ -100,4 +100,10 @@ default RepairTable repairTable(Table table) {
     throw new UnsupportedOperationException(
         this.getClass().getName() + " does not implement repairTable");
   }
+
+  /** Instantiates an action to rotate the encryption keys of a table. */
+  default RotateEncryptionKeys rotateEncryptionKeys(Table table) {
+    throw new UnsupportedOperationException(
+        this.getClass().getName() + " does not implement rotateEncryptionKeys");
+  }
 }
diff --git a/api/src/main/java/org/apache/iceberg/actions/RotateEncryptionKeys.java b/api/src/main/java/org/apache/iceberg/actions/RotateEncryptionKeys.java
new file mode 100644
index 000000000000..6085fdc7cc2f
--- /dev/null
+++ b/api/src/main/java/org/apache/iceberg/actions/RotateEncryptionKeys.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.iceberg.actions;
+
+import org.apache.iceberg.ManifestFile;
+import org.apache.iceberg.RotateEncryptionKeys.KeyRegenerationLevel;
+
+/**
+ * An action that rotates the encryption keys of a table.
+ *
+ * <p>Similar to {@link org.apache.iceberg.RotateEncryptionKeys} but may use a query engine to
+ * distribute parts of the work.
+ */
+public interface RotateEncryptionKeys
+    extends SnapshotUpdate<RotateEncryptionKeys, RotateEncryptionKeys.Result> {
+
+  /**
+   * Sets the lowest key to regenerate.
+   *
+   * @param level the lowest key to regenerate
+   * @return this for method chaining
+   */
+  RotateEncryptionKeys keyRegenerationLevel(KeyRegenerationLevel level);
+
+  /** The action result that contains a summary of the execution. */
+  interface Result {
+    /** Returns the manifests written with new keys. */
+    Iterable<ManifestFile> addedManifests();
+  }
+}