API to support automated registration token rotation

We are concerned about the relatively static runner registration tokens, which, for example, if copied by an ex-employee would allow an imposter runner to register with gitlab. Therefore we would like to automate periodic replacement of the token, and we couldn’t find an API that would allow the reset and retrieval of the registration token that can be done via the GIU. Has anyone solved this token rotation problem or found a way to at least replace and return the token?