diff --git a/src/main/java/org/example/visacasemanagementsystem/config/OauthSuccessHandler.java b/src/main/java/org/example/visacasemanagementsystem/config/OauthSuccessHandler.java
index 0dd0a6d..edf45c0 100644
--- a/src/main/java/org/example/visacasemanagementsystem/config/OauthSuccessHandler.java
+++ b/src/main/java/org/example/visacasemanagementsystem/config/OauthSuccessHandler.java
@@ -3,35 +3,31 @@
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
-import org.example.visacasemanagementsystem.user.UserAuthorization;
 import org.example.visacasemanagementsystem.user.entity.User;
-import org.example.visacasemanagementsystem.user.repository.UserRepository;
 import org.example.visacasemanagementsystem.user.security.UserPrincipal;
+import org.example.visacasemanagementsystem.user.service.UserService;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.security.authentication.BadCredentialsException;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.oauth2.core.oidc.user.DefaultOidcUser;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
 import org.springframework.security.web.context.SecurityContextRepository;
+
 import java.io.IOException;
 import java.util.Objects;
-import java.util.UUID;
 
 @Configuration
 public class OauthSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
 
-    private final UserRepository userRepository;
-    private final PasswordEncoder passwordEncoder;
+    private final UserService userService;
     private final SecurityContextRepository securityContextRepository;
 
-    public OauthSuccessHandler(UserRepository userRepository, PasswordEncoder passwordEncoder, SecurityContextRepository securityContextRepository) {
-        this.userRepository = userRepository;
-        this.passwordEncoder = passwordEncoder;
+    public OauthSuccessHandler(UserService userService,
+                               SecurityContextRepository securityContextRepository) {
+        this.userService = userService;
         this.securityContextRepository = securityContextRepository;
     }
 
@@ -49,19 +45,9 @@ public void onAuthenticationSuccess(HttpServletRequest request,
             throw new BadCredentialsException("OAuth account missing verified email");
         }
 
-        User user = userRepository.findByEmail(email).orElseGet(() -> {
-            User newUser = new User();
-            newUser.setFullName(name);
-            newUser.setUsername(email);
-            newUser.setEmail(email);
-            newUser.setPassword(passwordEncoder.encode(UUID.randomUUID().toString()));
-            newUser.setUserAuthorization(UserAuthorization.USER);
-            try {
-                return userRepository.saveAndFlush(newUser);
-            } catch (DataIntegrityViolationException e) {
-                return userRepository.findByEmail(email).orElseThrow();
-            }
-        });
+        // Persistence + audit run inside a @Transactional service method so the
+        // transaction commits before we touch the SecurityContext or issue the redirect.
+        User user = userService.findOrCreateOauthUser(email, name);
 
         UserPrincipal principal = new UserPrincipal(user);
         Authentication auth = new UsernamePasswordAuthenticationToken(principal, null, principal.getAuthorities());
@@ -72,7 +58,7 @@ public void onAuthenticationSuccess(HttpServletRequest request,
 
         clearAuthenticationAttributes(request);
 
-        String targetUrl = "/dashboard";
+        String targetUrl = "/home";
         getRedirectStrategy().sendRedirect(request, response, targetUrl);
     }
 }
diff --git a/src/main/java/org/example/visacasemanagementsystem/user/controller/UserViewController.java b/src/main/java/org/example/visacasemanagementsystem/user/controller/UserViewController.java
index 8afd999..e294e3f 100644
--- a/src/main/java/org/example/visacasemanagementsystem/user/controller/UserViewController.java
+++ b/src/main/java/org/example/visacasemanagementsystem/user/controller/UserViewController.java
@@ -59,8 +59,12 @@ public String userSignupForm(@AuthenticationPrincipal UserPrincipal principal, M
     public String createUser(@RequestParam String fullName,
                              @RequestParam String email,
                              @RequestParam String password,
+                             @RequestParam String confirmPassword,
                              Model model) {
         try {
+            if (!password.equals(confirmPassword)) {
+                throw new IllegalArgumentException("Passwords do not match");
+            }
             CreateUserDTO dto = new CreateUserDTO(fullName, email, password, UserAuthorization.USER);
             userService.createUser(dto);
             return "redirect:/user/login";
@@ -144,12 +148,19 @@ public String showProfileEditForm(@AuthenticationPrincipal UserPrincipal princip
     public String updateProfile(@AuthenticationPrincipal UserPrincipal principal,
                                 @PathVariable Long userId,
                                 @RequestParam String fullName,
-                                @RequestParam String email,
+                                @RequestParam String password,
+                                @RequestParam String confirmPassword,
                                 Model model) {
         userService.validateProfileAccess(principal, userId);
 
         try {
-            UpdateUserDTO dto = new UpdateUserDTO(userId, fullName, email);
+            if (!password.equals(confirmPassword)) {
+                throw new IllegalArgumentException("Passwords do not match");
+            }
+            if (!password.isBlank() && password.length() < 8) {
+                throw new IllegalArgumentException("Password must be at least 8 characters");
+            }
+            UpdateUserDTO dto = new UpdateUserDTO(userId, fullName, password);
             userService.updateUser(dto, principal.getUserId());
             return "redirect:/profile/view/" + userId;
         } catch (IllegalArgumentException e) {
@@ -158,7 +169,7 @@ public String updateProfile(@AuthenticationPrincipal UserPrincipal principal,
             UserDTO existing = userService.findById(userId)
                     .orElseThrow(() -> new EntityNotFoundException("User not found"));
             model.addAttribute("error", e.getMessage());
-            model.addAttribute("user", new UserDTO(userId, fullName, email, existing.userAuthorization()));
+            model.addAttribute("user", new UserDTO(userId, fullName, existing.email(), existing.userAuthorization()));
             addAuthorizationFormAttributes(model, principal, userId);
             return "profile/edit";
         }
diff --git a/src/main/java/org/example/visacasemanagementsystem/user/dto/UpdateUserDTO.java b/src/main/java/org/example/visacasemanagementsystem/user/dto/UpdateUserDTO.java
index 11cb128..390fbc5 100644
--- a/src/main/java/org/example/visacasemanagementsystem/user/dto/UpdateUserDTO.java
+++ b/src/main/java/org/example/visacasemanagementsystem/user/dto/UpdateUserDTO.java
@@ -2,9 +2,11 @@
 
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
 
 public record UpdateUserDTO(
         @NotNull Long id,
         @NotBlank(message = "Full name must be specified") String fullName,
-        @NotBlank(message = "Email must be specified") String email) {
+        @NotNull(message = "Password must be provided (use empty string to skip change)")
+        @Pattern(regexp = "^$|.{8,}", message = "Password must be at least 8 characters") String password) {
 }
diff --git a/src/main/java/org/example/visacasemanagementsystem/user/mapper/UserMapper.java b/src/main/java/org/example/visacasemanagementsystem/user/mapper/UserMapper.java
index 881cd9c..5d10770 100644
--- a/src/main/java/org/example/visacasemanagementsystem/user/mapper/UserMapper.java
+++ b/src/main/java/org/example/visacasemanagementsystem/user/mapper/UserMapper.java
@@ -38,7 +38,5 @@ public void updateEntityFromDTO(UpdateUserDTO dto, User user) {
         if (dto == null || user == null) return;
 
         user.setFullName(dto.fullName());
-        user.setEmail(dto.email());
-        user.setUsername(dto.email());
     }
 }
diff --git a/src/main/java/org/example/visacasemanagementsystem/user/service/UserService.java b/src/main/java/org/example/visacasemanagementsystem/user/service/UserService.java
index 08f53e8..afac408 100644
--- a/src/main/java/org/example/visacasemanagementsystem/user/service/UserService.java
+++ b/src/main/java/org/example/visacasemanagementsystem/user/service/UserService.java
@@ -15,12 +15,14 @@
 import org.example.visacasemanagementsystem.user.security.UserPrincipal;
 import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
 import java.util.Objects;
 import java.util.Optional;
+import java.util.UUID;
 
 @PreAuthorize("isAuthenticated()")
 @Service
@@ -89,26 +91,64 @@ public UserDTO createUser(@Valid CreateUserDTO dto) {
 
     @Transactional
     public UserDTO updateUser(UpdateUserDTO dto, Long actorUserId) {
+        validateProfileAccess(getUserPrincipal(), dto.id());
         // Check if user and email exists
         User user = userRepository.findById(dto.id())
                 .orElseThrow(() -> new EntityNotFoundException(USER_NOT_FOUND));
 
+        if (!dto.password().isBlank()) {
+            user.setPassword(passwordEncoder.encode(dto.password()));
+        }
+
         User savedUser;
         try {
             userMapper.updateEntityFromDTO(dto, user);
             savedUser = userRepository.saveAndFlush(user);
         } catch (DataIntegrityViolationException e) {
-            throw new IllegalArgumentException("A user with this email already exists", e);
+            // Email is no longer mutable on this path, but other unique/integrity constraints
+            // (now or in the future) could still trip here, so the message stays generic.
+            throw new IllegalArgumentException("Data integrity violation while updating user", e);
         }
         userLogService.createUserLog(
                 actorUserId,
                 savedUser.getId(),
                 UserEventType.UPDATED,
-                "User profile updated (fullName/email)."
+                "User profile updated (fullName/password)."
         );
         return userMapper.toDTO(savedUser);
     }
 
+    /**
+     * OAuth login lookup-or-create. Used by OauthSuccessHandler to keep the persistence work
+     * inside a single short-lived transaction that commits before the success handler builds
+     * the SecurityContext and issues the redirect.
+     */
+    @PreAuthorize("permitAll()")
+    @Transactional
+    public User findOrCreateOauthUser(String email, String fullName) {
+        return userRepository.findByEmail(email).orElseGet(() -> {
+            User newUser = new User();
+            newUser.setFullName(fullName);
+            newUser.setUsername(email);
+            newUser.setEmail(email);
+            newUser.setPassword(passwordEncoder.encode(UUID.randomUUID().toString()));
+            newUser.setUserAuthorization(UserAuthorization.USER);
+            try {
+                User savedUser = userRepository.saveAndFlush(newUser);
+                userLogService.createUserLog(
+                        savedUser.getId(),
+                        savedUser.getId(),
+                        UserEventType.CREATED,
+                        "User account created via OAUTH2."
+                );
+                return savedUser;
+            } catch (DataIntegrityViolationException e) {
+                // Race: another concurrent OAuth login created the row first. Re-read.
+                return userRepository.findByEmail(email).orElseThrow();
+            }
+        });
+    }
+
     @PreAuthorize("hasRole('SYSADMIN')")
     @Transactional
     public UserDTO updateUserAuthorization(Long actorUserId, Long targetUserId, UserAuthorization newAuth) {
@@ -154,4 +194,15 @@ public void validateProfileAccess(UserPrincipal principal, Long userId) {
             throw new UnauthorizedException("You do not have permission to edit this profile.");
         }
     }
+
+    private static UserPrincipal getUserPrincipal() {
+        // Class-level @PreAuthorize("isAuthenticated()") guarantees an authentication is present.
+        Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
+        if (!(principal instanceof UserPrincipal userPrincipal)) {
+            throw new IllegalStateException(
+                    "Expected UserPrincipal in SecurityContext but got: "
+                            + (principal == null ? "null" : principal.getClass().getName()));
+        }
+        return userPrincipal;
+    }
 }
diff --git a/src/main/resources/templates/profile/edit.html b/src/main/resources/templates/profile/edit.html
index b41393d..562cc75 100644
--- a/src/main/resources/templates/profile/edit.html
+++ b/src/main/resources/templates/profile/edit.html
@@ -47,11 +47,16 @@ <h1>Edit Profile</h1>
                            required>
                 </div>
                 <div class="form-group">
-                    <label>Email</label>
-                    <input type="email" name="email"
-                           th:value="${user.email()}"
-                           placeholder="you@example.com"
-                           required>
+                    <label>New Password <span style="color: var(--color-text-dim); font-weight: normal;">(leave blank to keep current)</span></label>
+                    <input type="password" name="password" id="password"
+                           placeholder="Min. 8 characters"
+                           minlength="8">
+                </div>
+                <div class="form-group">
+                    <label>Confirm New Password</label>
+                    <input type="password" name="confirmPassword" id="confirmPassword"
+                           placeholder="Repeat new password"
+                           minlength="8">
                 </div>
                 <!-- Read-only role display for any viewer who can't change it
                      (the user themselves, or any non-sysadmin). Sysadmins viewing
@@ -94,5 +99,26 @@ <h1>Authorization</h1>
     </div>
 </div>
 
+<script>
+    // Attach the mismatch-check to the form that actually owns the password fields,
+    // not to whatever 'form' querySelector picks first — the sysadmin authorization
+    // form on the same page would otherwise trigger this handler too.
+    (function () {
+        const pw = document.getElementById('password');
+        const cpw = document.getElementById('confirmPassword');
+        if (!pw || !cpw) return;
+        const form = pw.form || cpw.form;
+        if (!form) return;
+        form.addEventListener('submit', function (e) {
+            if (pw.value !== cpw.value) {
+                cpw.setCustomValidity('Passwords do not match');
+                cpw.reportValidity();
+                e.preventDefault();
+            } else {
+                cpw.setCustomValidity('');
+            }
+        });
+    })();
+</script>
 </body>
 </html>
diff --git a/src/main/resources/templates/user/signup.html b/src/main/resources/templates/user/signup.html
index 1262191..d923627 100644
--- a/src/main/resources/templates/user/signup.html
+++ b/src/main/resources/templates/user/signup.html
@@ -52,8 +52,17 @@ <h1>Create Account</h1>
 
         <div class="form-group">
             <label>Password</label>
-            <input type="password" name="password"
-                   placeholder="Choose a password"
+            <input type="password" name="password" id="password"
+                   placeholder="Min. 8 characters"
+                   minlength="8"
+                   required>
+        </div>
+
+        <div class="form-group">
+            <label>Confirm Password</label>
+            <input type="password" name="confirmPassword" id="confirmPassword"
+                   placeholder="Repeat your password"
+                   minlength="8"
                    required>
         </div>
 
@@ -65,5 +74,24 @@ <h1>Create Account</h1>
     </form>
 </div>
 
+<script>
+    (function () {
+        const pw = document.getElementById('password');
+        const cpw = document.getElementById('confirmPassword');
+        if (!pw || !cpw) return;
+        const form = pw.form || cpw.form;
+        if (!form) return;
+        form.addEventListener('submit', function (e) {
+            if (pw.value !== cpw.value) {
+                cpw.setCustomValidity('Passwords do not match');
+                cpw.reportValidity();
+                e.preventDefault();
+            } else {
+                cpw.setCustomValidity('');
+            }
+        });
+    })();
+</script>
+
 </body>
 </html>
diff --git a/src/test/java/org/example/visacasemanagementsystem/user/controller/UserViewControllerTest.java b/src/test/java/org/example/visacasemanagementsystem/user/controller/UserViewControllerTest.java
index 0b86301..3f523d0 100644
--- a/src/test/java/org/example/visacasemanagementsystem/user/controller/UserViewControllerTest.java
+++ b/src/test/java/org/example/visacasemanagementsystem/user/controller/UserViewControllerTest.java
@@ -94,6 +94,7 @@ void createUser_WithValidData_ShouldRedirectToLogin() throws Exception {
                         .param("fullName", "New Applicant")
                         .param("email", "new@test.com")
                         .param("password", "securePass1")
+                        .param("confirmPassword", "securePass1")
                         .with(csrf()))
                 .andExpect(status().is3xxRedirection())
                 .andExpect(redirectedUrl("/user/login"));
@@ -113,6 +114,7 @@ void createUser_WithDuplicateEmail_ShouldReturnSignupViewWithError() throws Exce
                         .param("fullName", "Duplicate User")
                         .param("email", "existing@test.com")
                         .param("password", "password123")
+                        .param("confirmPassword", "password123")
                         .with(csrf()))
                 .andExpect(status().isOk())
                 .andExpect(view().name("user/signup"))
@@ -131,6 +133,7 @@ void createUser_WithShortPassword_ShouldReturnSignupViewWithError() throws Excep
                         .param("fullName", "Short Pass")
                         .param("email", "short@test.com")
                         .param("password", "abc")
+                        .param("confirmPassword", "abc")
                         .with(csrf()))
                 .andExpect(status().isOk())
                 .andExpect(view().name("user/signup"))
@@ -259,7 +262,8 @@ void updateProfile_WithValidData_ShouldRedirectToProfileView() throws Exception
         // Act & Assert
         mockMvc.perform(post("/profile/edit/" + userId)
                         .param("fullName", "Updated Name")
-                        .param("email", "updated@test.com")
+                        .param("password", "newPassword")
+                        .param("confirmPassword", "newPassword")
                         .with(authentication(authFor(userId, "Test User", "user@test.com", UserAuthorization.USER)))
                         .with(csrf()))
                 .andExpect(status().is3xxRedirection())
@@ -281,7 +285,8 @@ void updateProfile_WithDuplicateEmail_ShouldReturnEditViewWithError() throws Exc
         // Act & Assert
         mockMvc.perform(post("/profile/edit/" + userId)
                         .param("fullName", "Test User")
-                        .param("email", "taken@test.com")
+                        .param("password", "newPassword")
+                        .param("confirmPassword", "newPassword")
                         .with(authentication(authFor(userId, "Test User", "user@test.com", UserAuthorization.USER)))
                         .with(csrf()))
                 .andExpect(status().isOk())
@@ -302,7 +307,8 @@ void updateProfile_WhenUserConcurrentlyDeleted_ShouldReturnNotFound() throws Exc
         // Act & Assert — handled by GlobalExceptionHandler → 404
         mockMvc.perform(post("/profile/edit/" + userId)
                         .param("fullName", "Test User")
-                        .param("email", "taken@test.com")
+                        .param("password", "newPassword")
+                        .param("confirmPassword", "newPassword")
                         .with(authentication(authFor(userId, "Test User", "user@test.com", UserAuthorization.USER)))
                         .with(csrf()))
                 .andExpect(status().isNotFound());
@@ -320,7 +326,8 @@ void updateProfile_AsUnauthorizedUser_ShouldReturnForbidden() throws Exception {
         // Act & Assert
         mockMvc.perform(post("/profile/edit/" + targetUserId)
                         .param("fullName", "Hacked")
-                        .param("email", "hacked@test.com")
+                        .param("password", "newPassword")
+                        .param("confirmPassword", "newPassword")
                         .with(authentication(authFor(1L, "Test User", "user@test.com", UserAuthorization.USER)))
                         .with(csrf()))
                 .andExpect(status().isForbidden());
diff --git a/src/test/java/org/example/visacasemanagementsystem/user/mapper/UserMapperTest.java b/src/test/java/org/example/visacasemanagementsystem/user/mapper/UserMapperTest.java
index a7494c6..f810bd2 100644
--- a/src/test/java/org/example/visacasemanagementsystem/user/mapper/UserMapperTest.java
+++ b/src/test/java/org/example/visacasemanagementsystem/user/mapper/UserMapperTest.java
@@ -99,7 +99,7 @@ void shouldReturnNullEntity_WhenCreateUserDTOIsNull() {
     }
 
     @Test
-    @DisplayName("Checking if updateEntityFromDTO overwrites fullName, email, and username on an existing User entity")
+    @DisplayName("Checking if updateEntityFromDTO overwrites fullName on an existing User entity")
     void shouldUpdateExistingUserEntityFromUpdateUserDTO() {
         // Arrange
         User user = new User();
@@ -109,15 +109,13 @@ void shouldUpdateExistingUserEntityFromUpdateUserDTO() {
         user.setPassword("password123");
         user.setUserAuthorization(UserAuthorization.USER);
 
-        UpdateUserDTO dto = new UpdateUserDTO(1L, "New Name", "new@example.com");
+        UpdateUserDTO dto = new UpdateUserDTO(1L, "New Name", "");
 
         // Act
         userMapper.updateEntityFromDTO(dto, user);
 
         // Assert
         assertThat(user.getFullName()).isEqualTo("New Name");
-        assertThat(user.getEmail()).isEqualTo("new@example.com");
-        assertThat(user.getUsername()).isEqualTo("new@example.com");
     }
 
     @Test
@@ -131,7 +129,7 @@ void shouldNotModifyAuthorizationOrPassword_WhenUpdatingFromDTO() {
         user.setPassword("secret123");
         user.setUserAuthorization(UserAuthorization.SYSADMIN);
 
-        UpdateUserDTO dto = new UpdateUserDTO(1L, "Changed Name", "changed@example.com");
+        UpdateUserDTO dto = new UpdateUserDTO(1L, "Changed Name", "newPassword123");
 
         // Act
         userMapper.updateEntityFromDTO(dto, user);
@@ -163,7 +161,7 @@ void shouldNotUpdateEntity_WhenUpdateDTOIsNull() {
     @DisplayName("Checking if updateEntityFromDTO does not throw when the User entity is null")
     void shouldNotThrow_WhenUserIsNullInUpdate() {
         // Arrange
-        UpdateUserDTO dto = new UpdateUserDTO(1L, "Some Name", "some@example.com");
+        UpdateUserDTO dto = new UpdateUserDTO(1L, "Some Name", "somePassword1");
 
         // Act & Assert
         assertThatCode(() -> userMapper.updateEntityFromDTO(dto, null))
diff --git a/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceIntegrationTest.java b/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceIntegrationTest.java
index acf779b..8a6aa3b 100644
--- a/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceIntegrationTest.java
+++ b/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceIntegrationTest.java
@@ -17,6 +17,7 @@
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
@@ -39,6 +40,8 @@ class UserServiceIntegrationTest {
 
     @MockitoBean
     private FileService fileService;
+    @Autowired
+    private PasswordEncoder passwordEncoder;
 
     @AfterEach
     void tearDown() {
@@ -70,23 +73,41 @@ void createUser_shouldSaveUser_WhenDataIsValid() {
     }
 
     @Test
-    @DisplayName("Checking if updateUser changes fullName and email in the database")
+    @DisplayName("Checking if updateUser changes fullName and password in the database")
     void updateUser_shouldUpdateUserFields_WhenDataIsValid() {
         // Arrange
         User user = createAndSaveValidUser();
         authenticateUser(user);
-        UpdateUserDTO dto = new UpdateUserDTO(user.getId(), "Updated Name", "updated@integration.test");
+        UpdateUserDTO dto = new UpdateUserDTO(user.getId(), "Updated Name", "newPassword");
 
         // Act — actor is the user themselves editing their own profile
         UserDTO result = userService.updateUser(dto, user.getId());
 
         // Assert
         assertThat(result.fullName()).isEqualTo("Updated Name");
-        assertThat(result.email()).isEqualTo("updated@integration.test");
 
         User updatedUser = userRepository.findById(user.getId()).orElseThrow();
         assertThat(updatedUser.getFullName()).isEqualTo("Updated Name");
-        assertThat(updatedUser.getEmail()).isEqualTo("updated@integration.test");
+        assertThat(passwordEncoder.matches("newPassword", updatedUser.getPassword())).isTrue();
+    }
+
+    @Test
+    @DisplayName("Checking if updateUser leaves the password unchanged when an empty password is provided (skip-change branch)")
+    void updateUser_shouldSkipPasswordChange_WhenPasswordIsEmpty() {
+        // Arrange — capture the originally-saved (already encoded) password hash
+        User user = createAndSaveValidUser();
+        authenticateUser(user);
+        String originalHash = userRepository.findById(user.getId()).orElseThrow().getPassword();
+
+        UpdateUserDTO dto = new UpdateUserDTO(user.getId(), "NameChange", "");
+
+        // Act
+        userService.updateUser(dto, user.getId());
+
+        // Assert — fullName changed, password hash untouched
+        User updatedUser = userRepository.findById(user.getId()).orElseThrow();
+        assertThat(updatedUser.getFullName()).isEqualTo("NameChange");
+        assertThat(updatedUser.getPassword()).isEqualTo(originalHash);
     }
 
     @Test
diff --git a/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceTest.java b/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceTest.java
index 1dc35e8..c3460ee 100644
--- a/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceTest.java
+++ b/src/test/java/org/example/visacasemanagementsystem/user/service/UserServiceTest.java
@@ -12,6 +12,7 @@
 import org.example.visacasemanagementsystem.user.mapper.UserMapper;
 import org.example.visacasemanagementsystem.user.repository.UserRepository;
 import org.example.visacasemanagementsystem.user.security.UserPrincipal;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -19,6 +20,9 @@
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.crypto.password.PasswordEncoder;
 
 import java.util.Optional;
@@ -43,6 +47,11 @@ class UserServiceTest {
     @InjectMocks
     private UserService userService;
 
+    @AfterEach
+    void clearSecurityContext() {
+        SecurityContextHolder.clearContext();
+    }
+
     // ── createUser ────────────────────────────────────────────────────────────
 
     @Test
@@ -121,7 +130,11 @@ void createUser_shouldSaveAndReturnUserDTO_WhenDataIsValid() {
     @DisplayName("Checking if updateUser throws EntityNotFoundException when user ID does not exist")
     void updateUser_shouldThrowEntityNotFoundException_WhenUserDoesNotExist() {
         // Arrange
-        UpdateUserDTO dto = new UpdateUserDTO(999L, "Name", "email@test.com");
+        User sysadmin = buildUser("sysadmin", UserAuthorization.SYSADMIN);
+        sysadmin.setId(1L);
+        authenticateUser(sysadmin);
+
+        UpdateUserDTO dto = new UpdateUserDTO(999L, "Name", "newPassword1");
         when(userRepository.findById(999L)).thenReturn(Optional.empty());
 
         // Act & Assert
@@ -131,23 +144,23 @@ void updateUser_shouldThrowEntityNotFoundException_WhenUserDoesNotExist() {
     }
 
     @Test
-    @DisplayName("Checking if updateUser throws IllegalArgumentException when new email is already taken by another user")
-    void updateUser_shouldThrowIllegalArgumentException_WhenEmailAlreadyExists() {
-        // Arrange
+    @DisplayName("Checking if updateUser throws IllegalArgumentException when saveAndFlush violates a DB integrity constraint")
+    void updateUser_shouldThrowIllegalArgumentException_WhenDataIntegrityViolation() {
         Long userId = 1L;
-        UpdateUserDTO dto = new UpdateUserDTO(userId, "User", "taken@test.com");
-
-        User existingUser = new User();
+        User existingUser = buildUser("user", UserAuthorization.USER);
         existingUser.setId(userId);
+        authenticateUser(existingUser);
+
+        UpdateUserDTO dto = new UpdateUserDTO(userId, "User", "newPassword1");
 
         when(userRepository.findById(userId)).thenReturn(Optional.of(existingUser));
         when(userRepository.saveAndFlush(any(User.class)))
-                .thenThrow(new DataIntegrityViolationException("unique constraint"));
+                .thenThrow(new DataIntegrityViolationException("constraint violation"));
 
         // Act & Assert
         assertThatThrownBy(() -> userService.updateUser(dto, userId))
                 .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("email already exists");
+                .hasMessageContaining("Data integrity violation");
     }
 
     @Test
@@ -155,10 +168,11 @@ void updateUser_shouldThrowIllegalArgumentException_WhenEmailAlreadyExists() {
     void updateUser_shouldUpdateAndReturnUser_WhenDataIsValid() {
         // Arrange
         Long userId = 1L;
-        UpdateUserDTO dto = new UpdateUserDTO(userId, "Updated Name", "updated@test.com");
+        UpdateUserDTO dto = new UpdateUserDTO(userId, "Updated Name", "newPassword1");
 
-        User existingUser = new User();
+        User existingUser = buildUser("user", UserAuthorization.USER);
         existingUser.setId(userId);
+        authenticateUser(existingUser);
         UserDTO expectedDTO = new UserDTO(userId, "Updated Name", "updated@test.com", UserAuthorization.USER);
 
         when(userRepository.findById(userId)).thenReturn(Optional.of(existingUser));
@@ -309,5 +323,25 @@ void findByEmail_shouldReturnEmpty_WhenEmailDoesNotExist() {
         // Act & Assert
         assertThat(userService.findByEmail("nobody@test.com")).isEmpty();
     }
+
+    // ── Helper methods ────────────────────────────────────────────────────────
+
+    private User buildUser(String name, UserAuthorization auth) {
+        User user = new User();
+        String uniqueEmail = java.util.UUID.randomUUID() + "@test.com";
+        user.setFullName(name);
+        user.setEmail(uniqueEmail);
+        user.setUsername(uniqueEmail);
+        user.setPassword("password123");
+        user.setUserAuthorization(auth);
+        return user;
+    }
+
+    private UserPrincipal authenticateUser(User user) {
+        UserPrincipal principal = new UserPrincipal(user);
+        Authentication authentication = new TestingAuthenticationToken(principal, "password123", principal.getAuthorities());
+        SecurityContextHolder.getContext().setAuthentication(authentication);
+        return principal;
+    }
 }
    
\ No newline at end of file