to be more precise, it's a gcp secret_version for res1, and a cloudrun service for res2. I tried to use a depends_on on the secret_version but even though the secret_version gets replaced, it doesn"t trigger an update for the service.