diff --git a/controllers/userController.go b/controllers/userController.go
index 57d048b..9150272 100644
--- a/controllers/userController.go
+++ b/controllers/userController.go
@@ -3,6 +3,7 @@ package controllers
 import (
 	"net/http"
 	"strconv"
+	"strings"
 
 	"nearle/models"
 	"nearle/services"
@@ -141,6 +142,17 @@ func (ctl *UserController) UpdateStaff(c *fiber.Ctx) error {
 		})
 	}
 
+	// This endpoint also doubles as the password-setup/reset call (userid +
+	// password only, everything else left zero so GORM's Updates skips it) —
+	// guard the one field that has no validation anywhere else on this path.
+	if pw := strings.TrimSpace(user.Password); pw != "" && len(pw) < 6 {
+		return c.Status(http.StatusBadRequest).JSON(fiber.Map{
+			"status":  false,
+			"code":    http.StatusBadRequest,
+			"message": "Password must be at least 6 characters",
+		})
+	}
+
 	if err := ctl.userService.UpdateStaff(user); err != nil {
 		return c.JSON(fiber.Map{
 			"status":  false,