The usual answer to that is to dictate a minimum difference policy between credentials (meaning you have to provide the previous password at the point of change

The usual answer to that is to dictate a minimum difference policy between credentials (meaning you have to provide the previous password at the point of change as it can't be read from elsewhere if properly stored, but that is usually the case as a check against someone changing passwords using a session that is accidentally left unlocked). That can lead to passwords-on-paper which is an issue itself, though not a high risk if security against remote attackers is your only significant threat profile.