Don't do this. The entire premise of a password hash is that the authenticator, in its entirety, is disclosed; the job of the password hash is maximize the cost of backing the authenticator out to the password itself.

Of course, it's good to make it harder to exfiltrate the authenticator! And that's really what things like "peppers" are trying to do. But if you're going to build up that defense, be serious about it: move the password hashes entirely out of the application and its accessible storage (don't just spread it across two different kinds of storage the application already has access to!).

So, rather than pretending like you're improving security by keying the password hash, just stand up an authentication service. Give it "verify(user, password) bool" and "enroll(user, password)" and nothing else. Write it in a managed language with a minimal runtime (Rust, Go, or Java, no framework). Then, before you ever think about monkeying with the hash constructions themselves, get to work on segregating it out so that it's in its own AWS or GCP account, enforces rate limits, &c. You will never run out of better ways to secure the authentication services than this "pepper" nonsense.