diff --git a/server/src/db/models/User.ts b/server/src/db/models/User.ts
index 6aa3835a6..ac3895301 100644
--- a/server/src/db/models/User.ts
+++ b/server/src/db/models/User.ts
@@ -50,24 +50,6 @@ const UserSchema = new Schema<UserDocument>(
 	{ timestamps: true }
 );
 
-UserSchema.pre("save", function (next) {
-	if (!this.isModified("password")) {
-		return next();
-	}
-	const salt = bcrypt.genSaltSync(10);
-	this.password = bcrypt.hashSync(this.password, salt);
-	next();
-});
-
-UserSchema.pre("findOneAndUpdate", function (next) {
-	const update = this.getUpdate();
-	if (update && "password" in update) {
-		const salt = bcrypt.genSaltSync(10);
-		(update as any).password = bcrypt.hashSync((update as any).password, salt);
-	}
-	next();
-});
-
 UserSchema.pre("findOneAndDelete", async function (next) {
 	try {
 		const userToDelete = await this.model.findOne(this.getFilter());
diff --git a/server/src/service/business/userService.ts b/server/src/service/business/userService.ts
index 281c03ab7..39b05a737 100644
--- a/server/src/service/business/userService.ts
+++ b/server/src/service/business/userService.ts
@@ -16,6 +16,11 @@ const SERVICE_NAME = "userService";
 class UserService {
 	static SERVICE_NAME = SERVICE_NAME;
 
+	private hashPassword = (password: string): string => {
+		const salt = bcrypt.genSaltSync(10);
+		return bcrypt.hashSync(password, salt);
+	};
+
 	private emailService: any;
 	private settingsService: any;
 	private logger: any;
@@ -103,7 +108,12 @@ class UserService {
 			user.role = ["superadmin"];
 		}
 
-		const newUser = await this.usersRepository.create({ ...user }, file);
+		// Hash password before storing
+		if (user.password) {
+			user.password = this.hashPassword(user.password);
+		}
+
+		const newUser = await this.usersRepository.create(user, file);
 
 		this.logger.debug({
 			message: "New user created",
@@ -182,7 +192,8 @@ class UserService {
 				throw new AppError({ message: "Incorrect current password", service: SERVICE_NAME, status: 403 });
 			}
 			// If a match, update the password
-			updates.password = updates.newPassword;
+			updates.password = this.hashPassword(updates.newPassword);
+			delete updates.newPassword;
 		}
 
 		return await this.usersRepository.updateById(currentUser.id, updates, file);
@@ -225,8 +236,8 @@ class UserService {
 			throw new AppError({ message: "New password cannot be same as old password", service: SERVICE_NAME, status: 400 });
 		}
 
-		existingUser.password = password;
-		await this.usersRepository.updateById(existingUser.id, existingUser, null);
+		const hashedPassword = this.hashPassword(password);
+		await this.usersRepository.updateById(existingUser.id, { password: hashedPassword }, null);
 		await this.recoveryTokensRepository.deleteManyByEmail(existingUser.email);
 
 		existingUser.password = "";
@@ -294,7 +305,8 @@ class UserService {
 	};
 
 	setPasswordByUserId = async (userId: any, password: string) => {
-		const updatedUser = await this.usersRepository.updateById(userId, { password }, null);
+		const hashedPassword = this.hashPassword(password);
+		const updatedUser = await this.usersRepository.updateById(userId, { password: hashedPassword }, null);
 		return updatedUser;
 	};
 }