diff --git a/src/invidious/routes/account.cr b/src/invidious/routes/account.cr
index c8db207c2..31bc69ea6 100644
--- a/src/invidious/routes/account.cr
+++ b/src/invidious/routes/account.cr
@@ -23,6 +23,8 @@ module Invidious::Routes::Account
     sid = sid.as(String)
     csrf_token = generate_response(sid, {":change_password"}, HMAC_KEY)
 
+    sso_verified = Invidious::TrustedHeaderAuth.asserted_email(env) == user.email
+
     templated "user/change_password"
   end
 
@@ -48,8 +50,13 @@ module Invidious::Routes::Account
       return error_template(400, ex)
     end
 
+    # An SSO session proves the identity through the trusted header already, so
+    # the current password is waived. Accounts provisioned by SSO were given a
+    # random password the user never saw and could never type here.
+    sso_verified = Invidious::TrustedHeaderAuth.asserted_email(env) == user.email
+
     password = env.params.body["password"]?
-    if password.nil? || password.empty?
+    if !sso_verified && (password.nil? || password.empty?)
       return error_template(401, "Password is a required field")
     end
 
@@ -68,8 +75,10 @@ module Invidious::Routes::Account
       return error_template(400, "Password cannot be longer than 55 characters")
     end
 
-    if !Crypto::Bcrypt::Password.new(user.password.not_nil!).verify(password.byte_slice(0, 55))
-      return error_template(401, "Incorrect password")
+    if !sso_verified
+      if !Crypto::Bcrypt::Password.new(user.password.not_nil!).verify(password.not_nil!.byte_slice(0, 55))
+        return error_template(401, "Incorrect password")
+      end
     end
 
     new_password = Crypto::Bcrypt::Password.create(new_password, cost: 10)
diff --git a/src/invidious/views/user/change_password.ecr b/src/invidious/views/user/change_password.ecr
index e22891d69..0ac5336bb 100644
--- a/src/invidious/views/user/change_password.ecr
+++ b/src/invidious/views/user/change_password.ecr
@@ -10,8 +10,10 @@
                 <legend><%= I18n.translate(locale, "Change password") %></legend>
 
                 <fieldset>
+                    <% if !sso_verified %>
                     <label for="password"><%= I18n.translate(locale, "Password") %> :</label>
                     <input required class="pure-input-1" name="password" type="password" placeholder="<%= I18n.translate(locale, "Password") %>">
+                    <% end %>
 
                     <label for="new_password[0]"><%= I18n.translate(locale, "New password") %> :</label>
                     <input required class="pure-input-1" name="new_password[0]" type="password" placeholder="<%= I18n.translate(locale, "New password") %>">