1 files changed, 11 insertions, 4 deletions
diff --git a/Jellyfin.Api/Controllers/StartupController.cs b/Jellyfin.Api/Controllers/StartupController.cs
index 4373a46adc..47c8f21241 100644
--- a/Jellyfin.Api/Controllers/StartupController.cs
+++ b/Jellyfin.Api/Controllers/StartupController.cs
@@ -140,18 +140,25 @@ public class StartupController : BaseJellyfinApiController
             return NotFound();
         }
 
-        if (string.IsNullOrWhiteSpace(startupUserDto.Password))
+        if (!string.IsNullOrEmpty(user.Password))
         {
-            return BadRequest("Password must not be empty");
+            return Forbid();
         }
 
-        if (startupUserDto.Name is not null)
+        if (string.IsNullOrWhiteSpace(startupUserDto.Password))
         {
-            user.Username = startupUserDto.Name;
+            return BadRequest("Password must not be empty");
         }
 
         await _userManager.UpdateUserAsync(user).ConfigureAwait(false);
 
+#pragma warning disable CA1309 // Use ordinal string comparison
+        if (startupUserDto.Name is not null && !startupUserDto.Name.Equals(user.Username, StringComparison.InvariantCultureIgnoreCase))
+        {
+            await _userManager.RenameUser(user.Id, user.Username, startupUserDto.Name).ConfigureAwait(false);
+        }
+#pragma warning restore CA1309 // Use ordinal string comparison
+
         if (!string.IsNullOrEmpty(startupUserDto.Password))
         {
             await _userManager.ChangePassword(user.Id, startupUserDto.Password).ConfigureAwait(false);