diff --git a/proto/caosdb/acm/v1alpha1/main.proto b/proto/caosdb/acm/v1alpha1/main.proto
index d8446165d8745210f82080fe2133ef906d99f5a6..0065b54bb613bba4f7d9b35b23e5586f7b5371ac 100644
--- a/proto/caosdb/acm/v1alpha1/main.proto
+++ b/proto/caosdb/acm/v1alpha1/main.proto
@@ -204,13 +204,19 @@ enum UserStatus {
   USER_STATUS_ACTIVE = 2;
 }
 
-// EmailSetting - it is handy to have this as a separate message b/c otherwise we could not distinguish between empty string and unset email.
+// PasswordSetting - it is handy to have this as a separate message b/c otherwise we could not distinguish between empty string and an unspecified password.
+message PasswordSetting {
+  // The password
+  string password = 1;
+}
+
+// EmailSetting - it is handy to have this as a separate message b/c otherwise we could not distinguish between empty string and an unspecified email.
 message EmailSetting {
   // The email adress
   string email = 1;
 }
 
-// EntitySetting - it is handy to have this as a separate message b/c otherwise we could not distinguish between empty string and unset email.
+// EntitySetting - it is handy to have this as a separate message b/c otherwise we could not distinguish between empty string and an unspecified entity.
 message EntitySetting {
   // The entity which represents this user (e.g. a Person or Device Record).
   string entity_id = 1;
@@ -255,7 +261,7 @@ message CreateSingleUserRequest {
   // The new user.
   User user = 1;
   // The new password.
-  string password = 2;
+  PasswordSetting password_setting = 2;
 }
 
 // Response message for the CreateSingeUser RPC
@@ -311,8 +317,8 @@ message RetrieveSingleUserResponse {
 message UpdateSingleUserRequest {
   // The new user.
   User user = 1;
-  // The new password. Password will not be updated when this is empty.
-  string password = 2;
+  // The new password. Password will not be updated when this is unset.
+  PasswordSetting password_setting = 2;
 }
 
 // Response message for the UpdateSingleUser RPC