diff --git a/services/web/app/views/user/settings.pug b/services/web/app/views/user/settings.pug
index 497de3a01d..3d7692dd7c 100644
--- a/services/web/app/views/user/settings.pug
+++ b/services/web/app/views/user/settings.pug
@@ -75,49 +75,64 @@ block content
 
 								.col-md-5.col-md-offset-1
 									h3 #{translate("change_password")}
-									form(async-form="changepassword", name="changePasswordForm", action="/change_password/v1", method="POST", novalidate)
-										input(type="hidden", name="_csrf", value=csrfToken)
-										.form-group
-											label(for='currentPassword') #{translate("current_password")}
-											input.form-control(
-												type='password',
-												name='currentPassword',
-												placeholder='*********',
-												ng-model="currentPassword",
-												required
-											)
-											span.small.text-primary(ng-show="changePasswordForm.currentPassword.$invalid && changePasswordForm.currentPassword.$dirty")
-												| #{translate("required")}
-										.form-group
-											label(for='newPassword1') #{translate("new_password")}
-											input.form-control(
-												id='passwordField',
-												type='password',
-												name='newPassword1',
-												placeholder='*********',
-												ng-model="newPassword1",
-												required,
-												complex-password
-											)
-											span.small.text-primary(ng-show="changePasswordForm.newPassword1.$error.complexPassword && changePasswordForm.newPassword1.$dirty", ng-bind-html="complexPasswordErrorMessage") 
-										.form-group
-											label(for='newPassword2') #{translate("confirm_new_password")}
-											input.form-control(
-												type='password',
-												name='newPassword2',
-												placeholder='*********',
-												ng-model="newPassword2",
-												equals="passwordField"
-											) 
-											span.small.text-primary(ng-show="changePasswordForm.newPassword2.$error.areEqual && changePasswordForm.newPassword2.$dirty")
-												| #{translate("doesnt_match")} 
-											span.small.text-primary(ng-show="!changePasswordForm.newPassword2.$error.areEqual && changePasswordForm.newPassword2.$invalid && changePasswordForm.newPassword2.$dirty")
-												| #{translate("invalid_password")} 
-										.actions
-											button.btn.btn-primary(
-												type='submit',
-												ng-disabled="changePasswordForm.$invalid"
-											) #{translate("change")}
+									if externalAuthenticationSystemUsed() && !settings.overleaf
+										p
+											Password settings are managed externally to Overleaf
+									else
+										- var submitAction
+										if settings.overleaf
+											- submitAction = '/change_password/v1'
+										else
+											- submitAction = '/user/password/update'
+										form(
+											async-form="changepassword"
+											name="changePasswordForm"
+											action=submitAction
+											method="POST"
+											novalidate
+										)
+											input(type="hidden", name="_csrf", value=csrfToken)
+											.form-group
+												label(for='currentPassword') #{translate("current_password")}
+												input.form-control(
+													type='password',
+													name='currentPassword',
+													placeholder='*********',
+													ng-model="currentPassword",
+													required
+												)
+												span.small.text-primary(ng-show="changePasswordForm.currentPassword.$invalid && changePasswordForm.currentPassword.$dirty")
+													| #{translate("required")}
+											.form-group
+												label(for='newPassword1') #{translate("new_password")}
+												input.form-control(
+													id='passwordField',
+													type='password',
+													name='newPassword1',
+													placeholder='*********',
+													ng-model="newPassword1",
+													required,
+													complex-password
+												)
+												span.small.text-primary(ng-show="changePasswordForm.newPassword1.$error.complexPassword && changePasswordForm.newPassword1.$dirty", ng-bind-html="complexPasswordErrorMessage") 
+											.form-group
+												label(for='newPassword2') #{translate("confirm_new_password")}
+												input.form-control(
+													type='password',
+													name='newPassword2',
+													placeholder='*********',
+													ng-model="newPassword2",
+													equals="passwordField"
+												) 
+												span.small.text-primary(ng-show="changePasswordForm.newPassword2.$error.areEqual && changePasswordForm.newPassword2.$dirty")
+													| #{translate("doesnt_match")} 
+												span.small.text-primary(ng-show="!changePasswordForm.newPassword2.$error.areEqual && changePasswordForm.newPassword2.$invalid && changePasswordForm.newPassword2.$dirty")
+													| #{translate("invalid_password")} 
+											.actions
+												button.btn.btn-primary(
+													type='submit',
+													ng-disabled="changePasswordForm.$invalid"
+												) #{translate("change")}
 
 							| !{moduleIncludes("userSettings", locals)}