A database password rotates successfully, but some long-running services keep stale cached credentials. Which practices support reliable secret rotation? Select 2 answers.

1. Make clients refresh according to an appropriate policy and handle rotation-related reconnects or authentication failures.
2. Coordinate the secret store and actual database credential through a supported tested rotation workflow.
3. Assume every client cache is invalidated automatically by any secret update.
4. Disable rotation permanently because one client needs a refresh fix.
5. Log the old and new plaintext passwords in the public deployment output.