You can do it in place, that's what I did with the server.

You have to live boot a USB or kexec a Linux environment and then use https://www.man7.org/linux/man-pages/man8/cryptsetup-reencrypt.8.html together with --reduce-device-size 32M and disk partitioning tools.