We ended up fixing it by enabling Customize Password Reset Page in Hosted Pages, then changing the password_policy line from:
password_policy: ‘{{password_policy}}’,
to:
password_policy: null,
Then we disabled Customize Password Reset Page again.