diff --git a/backend/src/api/routes/users.ts b/backend/src/api/routes/users.ts
index e249d3eb4..0b6d81ec2 100644
--- a/backend/src/api/routes/users.ts
+++ b/backend/src/api/routes/users.ts
@@ -217,7 +217,7 @@ router.patch(
   RateLimit.userUpdateEmail,
   validateRequest({
     body: {
-      newPassword: joi.string().required(),
+      newPassword: joi.string().min(6).required(),
     },
   }),
   asyncHandler(UserController.updatePassword)