As a peer post of yours pointed out, NIST changed guidance to discourage password changes years ago:

https://pages.nist.gov/800-63-3/sp800-63b.html#memorizedsecr...