Cloud credentials for a team's deploy pipeline

Your team of 40 engineers runs 12 services in one cloud account. A hosted CI service runs the tests on every push to any branch, about 500 jobs a day. A push to main also deploys to production, about 30 times a day.

The deploy step uses a cloud access key with full admin rights. The key sits in the CI service's settings, and every job on every branch can read it. Nobody has changed it in 3 years. Last week a new test printed all environment variables into a build log, and the key was in that log.

Your CI service gives each job a signed token that names the repository, the branch and the job. Your cloud account can be set to accept these tokens in exchange for credentials that last 1 hour.

Who can deploy to production after your change, and what does each job hold while it runs?