If you encrypt instead of peppering, you just decrypt then re-encrypt with a new key and call it a day.

Peppering has always meant, to me, doing something like this:

  // Hashing
  $preHash = base64_encode(
      hash_hmac('sha512', $password, $_ENV['pepper'], true)
  );
  $storedHash = password_hash($preHash, PASSWORD_DEFAULT);

  // Validation
  $preHash = base64_encode(
      hash_hmac('sha512', $password, $_ENV['pepper'], true)
  );
  if (password_verify($preHash, $storedHash)) {
      // You're in!
  }

To anyone reading this: Don't bother peppering.