How to run validation only when changeset is valid?

I’m continuing to work on a small Ash project and have a situation where I’m building out a validator to verify a user’s password before allowing changes to be made on the User’s password. However, if there are other errors on the form, I don’t want it running the hashing algorithm since it’s expensive. The action on the resource looks something like this:

update :update_password do
  # ... code here

  # Run validations
  validate {Validators.VerifyPassword, password_argument: :current_password}

  # ... more code here
end

When doing it this way, I have to check if the changeset is valid inside the validator itself before running. Something along the lines of this:

@impl true
def validate(%{valid?: false}, _opts, _context), do: :ok

@impl true
def validate(changeset, opts, _context) do
  # ... do actual validation here
end

The problem with this is I’m returning :ok even though the validation hasn’t been run, which feels wrong to me. I know there are where clauses that can be run like so:

# Run validations
validate {Validators.VerifyPassword, password_argument: :current_password} do
  where # ... some condition here
end

My question is, is there way to make that where clause check to see if the changeset itself is valid before running this validation? That feels a little more clean and logical to me than what I’m currently doing in the validator module for it. I checked the documentation and there are a few examples of using where, but I still don’t fully understand all the possible options for it are. Would I have to create another validator that checks to see if the changeset is valid and then have the where run that validator? Is there something easier and already built into Ash that I can use?