These credentials do not match our records. – Sanctum token persistence after password change

When a user updates their password in a Laravel Jetstream application, the goal is to immediately invalidate any existing Sanctum API tokens and authenticated web sessions so that leaked or stale credentials cannot continue to be used, aligning with a least‑privilege security model.

Jetstream’s default Fortify implementation does not automatically revoke tokens or sessions upon a password change, leaving previously issued credentials valid until their natural expiry. This behavior can be altered by custom Fortify features or event listeners, but the documentation does not clarify whether token revocation is intentionally omitted or configurable.

Is there a built‑in configuration flag to enable automatic token revocation on password change? How can developers safely hook into the password‑change event to delete Sanctum tokens without overriding Jetstream’s core? Does Fortify provide an observable event that can be used to invalidate both API tokens and web sessions?