diff --git a/foundations/core/packages/account-client/src/client.ts b/foundations/core/packages/account-client/src/client.ts
index 1a8e6ea430..3ca8d03799 100644
--- a/foundations/core/packages/account-client/src/client.ts
+++ b/foundations/core/packages/account-client/src/client.ts
@@ -237,7 +237,7 @@ export interface AccountClient {
   addEmailSocialId: (email: string) => Promise<OtpInfo>
   addHulyAssistantSocialId: () => Promise<PersonId>
   refreshHulyAssistantToken: () => Promise<void>
-  updatePasswordAgingRule: (days: number) => Promise<void>
+  updatePasswordAgingRule: (days?: number) => Promise<void>
   checkPasswordAging: () => Promise<boolean>
 
   setMyProfile: (profile: Partial<Omit<UserProfile, 'personUuid'>>) => Promise<void>
@@ -545,7 +545,7 @@ class AccountClientImpl implements AccountClient {
     await this.rpc(request)
   }
 
-  async updatePasswordAgingRule (days: number): Promise<void> {
+  async updatePasswordAgingRule (days?: number): Promise<void> {
     const request = {
       method: 'updatePasswordAgingRule' as const,
       params: { days }
diff --git a/foundations/core/packages/account-client/src/types.ts b/foundations/core/packages/account-client/src/types.ts
index c9f791f3c2..224773ec21 100644
--- a/foundations/core/packages/account-client/src/types.ts
+++ b/foundations/core/packages/account-client/src/types.ts
@@ -43,7 +43,7 @@ export interface LoginInfoWorkspace {
   role: AccountRole | null
   progress?: number
   branding?: string
-  passwordAgingRule?: number // in days
+  passwordAgingRule?: number | null // in days
 }
 
 export interface LoginInfoWithWorkspaces extends LoginInfo {
diff --git a/foundations/core/packages/core/src/classes.ts b/foundations/core/packages/core/src/classes.ts
index c9db96401a..c9630e3586 100644
--- a/foundations/core/packages/core/src/classes.ts
+++ b/foundations/core/packages/core/src/classes.ts
@@ -911,7 +911,7 @@ export interface WorkspaceInfo {
   billingAccount?: PersonUuid // Should always be set for NEW workspaces
   allowReadOnlyGuest?: boolean // Should always be set for NEW workspaces
   allowGuestSignUp?: boolean // Should always be set for NEW workspaces
-  passwordAgingRule?: number // in days
+  passwordAgingRule?: number | null // in days
 }
 
 export interface BackupStatus {
diff --git a/foundations/server/packages/server/src/sessionManager.ts b/foundations/server/packages/server/src/sessionManager.ts
index 0b97765794..55dfa351f8 100644
--- a/foundations/server/packages/server/src/sessionManager.ts
+++ b/foundations/server/packages/server/src/sessionManager.ts
@@ -766,7 +766,7 @@ export class TSessionManager implements SessionManager {
             this.workspaceInfoCache.delete(token.workspace)
           }
 
-          if (wsInfo.passwordAgingRule !== undefined && wsInfo.passwordAgingRule > 0) {
+          if (wsInfo.passwordAgingRule != null && wsInfo.passwordAgingRule > 0) {
             const isPasswordAgingOk = await this.checkPasswordAging(ctx, rawToken)
             if (!isPasswordAgingOk) {
               return { error: new Status(Severity.ERROR, platform.status.PasswordExpired, {}), terminate: true }
diff --git a/plugins/setting-resources/src/components/General.svelte b/plugins/setting-resources/src/components/General.svelte
index 9f1e4bc367..f65b08c947 100644
--- a/plugins/setting-resources/src/components/General.svelte
+++ b/plugins/setting-resources/src/components/General.svelte
@@ -149,7 +149,7 @@
   )
 
   async function changePasswordAgingRules (val: number | undefined): Promise<void> {
-    passwordAgingRule = Math.max(val ?? 1, 1)
+    passwordAgingRule = val !== undefined ? Math.max(val, 1) : undefined
     await accountClient.updatePasswordAgingRule(passwordAgingRule)
   }
 
diff --git a/server/account/src/collections/mongo.ts b/server/account/src/collections/mongo.ts
index b4e5e5e7af..18e0ff33b7 100644
--- a/server/account/src/collections/mongo.ts
+++ b/server/account/src/collections/mongo.ts
@@ -648,7 +648,7 @@ export class MongoAccountDB implements AccountDB {
     )
   }
 
-  async updatePasswordAgingRule (workspaceId: WorkspaceUuid, days: number): Promise<void> {
+  async updatePasswordAgingRule (workspaceId: WorkspaceUuid, days: number | null): Promise<void> {
     await this.workspace.update(
       {
         uuid: workspaceId
diff --git a/server/account/src/collections/postgres/postgres.ts b/server/account/src/collections/postgres/postgres.ts
index 4ab5aea2b1..a33587aabd 100644
--- a/server/account/src/collections/postgres/postgres.ts
+++ b/server/account/src/collections/postgres/postgres.ts
@@ -822,7 +822,7 @@ export class PostgresAccountDB implements AccountDB {
       .client`UPDATE ${this.client(this.workspace.getTableName())} SET allow_guest_sign_up = ${guestSignUpAllowed} WHERE uuid = ${workspaceId}`
   }
 
-  async updatePasswordAgingRule (workspaceId: WorkspaceUuid, days: number): Promise<void> {
+  async updatePasswordAgingRule (workspaceId: WorkspaceUuid, days: number | null): Promise<void> {
     await this
       .client`UPDATE ${this.client(this.workspace.getTableName())} SET password_aging_rule = ${days} WHERE uuid = ${workspaceId}`
   }
diff --git a/server/account/src/types.ts b/server/account/src/types.ts
index d946491c25..1a4e6140e1 100644
--- a/server/account/src/types.ts
+++ b/server/account/src/types.ts
@@ -115,7 +115,7 @@ export interface Workspace {
   url: string
   allowReadOnlyGuest: boolean
   allowGuestSignUp: boolean
-  passwordAgingRule?: number // Number of days after which password must be changed
+  passwordAgingRule?: number | null // Number of days after which password must be changed
   dataId?: WorkspaceDataId // Old workspace identifier. E.g. Database name in Mongo, bucket in R2, etc.
   branding?: string
   location?: Location
@@ -329,7 +329,7 @@ export interface AccountDB {
   createWorkspace: (data: WorkspaceData, status: WorkspaceStatusData) => Promise<WorkspaceUuid>
   updateAllowReadOnlyGuests: (workspaceId: WorkspaceUuid, readOnlyGuestsAllowed: boolean) => Promise<void>
   updateAllowGuestSignUp: (workspaceId: WorkspaceUuid, guestSignUpAllowed: boolean) => Promise<void>
-  updatePasswordAgingRule: (workspaceId: WorkspaceUuid, days: number) => Promise<void>
+  updatePasswordAgingRule: (workspaceId: WorkspaceUuid, days: number | null) => Promise<void>
   assignWorkspace: (accountId: AccountUuid, workspaceId: WorkspaceUuid, role: AccountRole) => Promise<void>
   batchAssignWorkspace: (data: [AccountUuid, WorkspaceUuid, AccountRole][]) => Promise<void>
   updateWorkspaceRole: (accountId: AccountUuid, workspaceId: WorkspaceUuid, role: AccountRole) => Promise<void>
@@ -455,7 +455,7 @@ export interface LoginInfoWorkspace {
 
   progress?: number
   branding?: string
-  passwordAgingRule?: number
+  passwordAgingRule?: number | null
 }
 
 export interface LoginInfoWithWorkspaces extends LoginInfo {
diff --git a/server/account/src/utils.ts b/server/account/src/utils.ts
index 3b787ec7a6..c9d7da66d0 100644
--- a/server/account/src/utils.ts
+++ b/server/account/src/utils.ts
@@ -951,7 +951,7 @@ export async function updatePasswordAgingRule (
   branding: Branding | null,
   token: string,
   params: {
-    days: number
+    days?: number
   }
 ): Promise<void> {
   const { days } = params
@@ -965,7 +965,7 @@ export async function updatePasswordAgingRule (
   if (accRole == null || getRolePower(accRole) < getRolePower(AccountRole.Maintainer)) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
   }
-  await db.updatePasswordAgingRule(workspace, days)
+  await db.updatePasswordAgingRule(workspace, days ?? null)
 }
 
 export async function checkPasswordAging (