diff --git a/packages/xo-server/src/xo-mixins/subjects.mjs b/packages/xo-server/src/xo-mixins/subjects.mjs
index 9c7287d51..df20cd9cf 100644
--- a/packages/xo-server/src/xo-mixins/subjects.mjs
+++ b/packages/xo-server/src/xo-mixins/subjects.mjs
@@ -150,8 +150,8 @@ export default class {
     if (permission) {
       user.permission = permission
     }
-    if (password) {
-      user.pw_hash = await hash(password)
+    if (password !== undefined) {
+      user.pw_hash = password === null ? undefined : await hash(password)
     }
 
     const newPreferences = { ...user.preferences }
@@ -179,6 +179,10 @@ export default class {
       user.authProviders = isEmpty(newAuthProviders) ? undefined : newAuthProviders
     }
 
+    if (user.pw_hash === undefined && isEmpty(user.authProviders) && id === this.apiContext?.user.id) {
+      throw new Error('current user cannot be without password and auth providers')
+    }
+
     // TODO: remove
     user.email = user.name
     delete user.name