diff --git a/api/auth.py b/api/auth.py
index 90a3001..fcb084c 100644
--- a/api/auth.py
+++ b/api/auth.py
@@ -85,6 +85,7 @@ async def tenant_scope(authorization: str = Header(default=""),
     "list_te":     frozenset({"uploader", "reviewer", "tenant_admin", "auditor"}),
     "delete_file": frozenset({"tenant_admin"}),
     "read_audit":  frozenset({"tenant_admin", "auditor"}),
+    "reset_password": frozenset({"tenant_admin"}),
 }
 
 
diff --git a/api/routers/auth_routes.py b/api/routers/auth_routes.py
index a7af6ce..baf4d14 100644
--- a/api/routers/auth_routes.py
+++ b/api/routers/auth_routes.py
@@ -10,10 +10,12 @@
 from fastapi import APIRouter, Depends, HTTPException
 from pydantic import BaseModel, Field
 
-from api.auth import bearer_token, require_session
+from api.auth import PERMISSIONS, bearer_token, require_session
 from api.db import Conn
 from api import oidc
 from api.services import accounts
+from api.services.audit import write_audit
+from api.tenancy import schema_for, scoped
 
 router = APIRouter(prefix="/api/auth", tags=["auth"])
 
@@ -69,3 +71,57 @@ def logout(token: str = Depends(bearer_token)) -> dict:
 @router.get("/me")
 def me(session: dict = Depends(require_session)) -> dict:
     return session
+
+
+_NewPassword = Field(min_length=accounts.MIN_PASSWORD, max_length=1024)
+
+
+class ChangePasswordRequest(BaseModel):
+    currentPassword: str = Field(min_length=1, max_length=1024)
+    newPassword: str = _NewPassword
+
+
+@router.post("/password")
+def change_password(req: ChangePasswordRequest, token: str = Depends(bearer_token),
+                    session: dict = Depends(require_session)) -> dict:
+    """Change your own password (#117). This session stays signed in; all others end.
+
+    A wrong current password is 400, not 401, so the browser keeps the session,
+    and it counts towards the lockout like a failed sign-in.
+    """
+    with Conn() as conn:
+        with conn.cursor() as cur:
+            ok = accounts.change_password(cur, session["userId"], token,
+                                          req.currentPassword, req.newPassword)
+        conn.commit()
+    if not ok:
+        raise HTTPException(status_code=400, detail="Current password is incorrect")
+    return {"status": "ok"}
+
+
+class ResetPasswordRequest(BaseModel):
+    newPassword: str = _NewPassword
+
+
+@router.post("/users/{username}/password")
+def reset_password(username: str, req: ResetPasswordRequest,
+                   session: dict = Depends(require_session)) -> dict:
+    """A tenant admin sets a member's password, unlocking the account and ending
+    its sessions (#117). Audited in the tenant's audit log."""
+    if session["role"] not in PERMISSIONS["reset_password"]:
+        raise HTTPException(status_code=403, detail=f"Role '{session['role']}' may not reset password")
+    with Conn() as conn:
+        with conn.cursor() as cur:
+            result = accounts.reset_password(cur, session["tenantId"], username, req.newPassword)
+            if result == "ok":
+                # ponytail: audit_log has file columns only; target in file_name and actor
+                # in mode until M3's audit_events (#107) adds actor and object.
+                with scoped(schema_for(session["tenant"])):
+                    write_audit(cur, "password_reset", None, username, None, f"by {session['username']}")
+        conn.commit()
+    if result == "missing":
+        raise HTTPException(status_code=404, detail="No such user in this tenant")
+    if result == "shared":
+        raise HTTPException(status_code=409, detail="This user is also in another tenant. "
+                            "An operator must reset it with scripts/reset_password.py")
+    return {"status": "ok"}
diff --git a/api/services/accounts.py b/api/services/accounts.py
index 2932e03..f778dea 100644
--- a/api/services/accounts.py
+++ b/api/services/accounts.py
@@ -15,6 +15,7 @@
 from api.config import settings
 
 ROLES = ("uploader", "reviewer", "tenant_admin", "auditor")
+MIN_PASSWORD = 12
 _N, _R, _P = 2**14, 8, 1
 
 
@@ -151,3 +152,54 @@ def session_for(cur, token: str) -> dict | None:
 def revoke(cur, token: str) -> None:
     cur.execute(_q("UPDATE {c}.sessions SET revoked_at = now() "
                    "WHERE token_hash = %s AND revoked_at IS NULL"), (_token_hash(token),))
+
+
+def _set_password(cur, user_id: int, password: str, keep_token: str | None = None) -> None:
+    """New hash, lockout cleared, and every session revoked except ``keep_token`` (#117)."""
+    cur.execute(_q("UPDATE {c}.users SET password_hash = %s, failed_logins = 0, "
+                   "first_failed_at = NULL, locked_until = NULL WHERE id = %s"),
+                (hash_password(password), user_id))
+    cur.execute(_q("UPDATE {c}.sessions SET revoked_at = now() WHERE user_id = %s "
+                   "AND revoked_at IS NULL AND token_hash IS DISTINCT FROM %s"),
+                (user_id, _token_hash(keep_token) if keep_token else None))
+
+
+def change_password(cur, user_id: int, token: str, current: str, new: str) -> bool:
+    """A signed-in user changes their own password; other sessions end. False if
+    ``current`` is wrong, which counts towards the lockout (#102)."""
+    cur.execute(_q("SELECT password_hash FROM {c}.users WHERE id = %s"), (user_id,))
+    row = cur.fetchone()
+    if not (row and verify_password(current, row[0])):
+        if row:
+            _record_failure(cur, user_id)
+        return False
+    _set_password(cur, user_id, new, keep_token=token)
+    return True
+
+
+def reset_password(cur, tenant_id: int, username: str, new: str) -> str:
+    """An admin sets a member's password; it also unlocks the account and ends all
+    of its sessions. Returns "ok", "missing" (not a member of ``tenant_id``) or
+    "shared": a user who is also in another tenant is refused, because the
+    password is global and one tenant's admin must not take over the others."""
+    cur.execute(_q("SELECT u.id, EXISTS (SELECT 1 FROM {c}.memberships o "
+                   "WHERE o.user_id = u.id AND o.tenant_id <> %s) "
+                   "FROM {c}.users u JOIN {c}.memberships m "
+                   "ON m.user_id = u.id AND m.tenant_id = %s WHERE u.username = %s"),
+                (tenant_id, tenant_id, username))
+    row = cur.fetchone()
+    if not row:
+        return "missing"
+    if row[1]:
+        return "shared"
+    _set_password(cur, row[0], new)
+    return "ok"
+
+
+def set_password(cur, username: str, new: str) -> bool:
+    """Break-glass reset by username, for an operator with database access (#117)."""
+    cur.execute(_q("SELECT id FROM {c}.users WHERE username = %s"), (username,))
+    row = cur.fetchone()
+    if row:
+        _set_password(cur, row[0], new)
+    return bool(row)
diff --git a/api/services/audit.py b/api/services/audit.py
index 59941e3..5b35d82 100644
--- a/api/services/audit.py
+++ b/api/services/audit.py
@@ -35,7 +35,7 @@
 
 # Actions the log is allowed to record. A typo becomes a loud failure here rather
 # than an unqueryable string in the table.
-VALID_ACTIONS = frozenset({"upload", "delete"})
+VALID_ACTIONS = frozenset({"upload", "delete", "password_reset"})
 
 
 def write_audit(cur, action: str, file_id: int | None, file_name: str | None,
diff --git a/csv-table-hub-main/src/__tests__/change-password.test.tsx b/csv-table-hub-main/src/__tests__/change-password.test.tsx
new file mode 100644
index 0000000..77d6caf
--- /dev/null
+++ b/csv-table-hub-main/src/__tests__/change-password.test.tsx
@@ -0,0 +1,80 @@
+// src/__tests__/change-password.test.tsx — change your own password (#117).
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { ChangePasswordForm } from "@/components/change-password";
+import { clearSession, getSession } from "@/lib/session";
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } });
+const session = {
+  token: "tok-123",
+  expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+  username: "alice",
+  tenant: "acme",
+  role: "uploader",
+};
+
+async function fill(current: string, next: string, confirm = next) {
+  const user = userEvent.setup();
+  await user.type(screen.getByLabelText("Current password"), current);
+  await user.type(screen.getByLabelText("New password"), next);
+  await user.type(screen.getByLabelText("Confirm new password"), confirm);
+  return user;
+}
+const submit = () => screen.getByRole("button", { name: /change password/i });
+
+beforeEach(() => {
+  clearSession();
+  sessionStorage.setItem("te.session", JSON.stringify(session));
+});
+afterEach(() => vi.unstubAllGlobals());
+
+describe("ChangePasswordForm", () => {
+  it("keeps the button disabled while the new password is short or doesn't match", async () => {
+    render(<ChangePasswordForm />);
+    await fill("old password!", "short");
+    expect(submit()).toBeDisabled();
+    expect(screen.getByText(/at least 12 characters/i)).toBeInTheDocument();
+  });
+
+  it("flags a mismatched confirmation", async () => {
+    render(<ChangePasswordForm />);
+    await fill("old password!", "a brand new passphrase", "a different passphrase");
+    expect(screen.getByText(/don't match/i)).toBeInTheDocument();
+    expect(submit()).toBeDisabled();
+  });
+
+  it("posts current and new password with the bearer token, then confirms", async () => {
+    const fetchMock = vi.fn(async () => json({ status: "ok" }));
+    vi.stubGlobal("fetch", fetchMock);
+    const onDone = vi.fn();
+    render(<ChangePasswordForm onDone={onDone} />);
+    const user = await fill("old password!", "a brand new passphrase");
+    await user.click(submit());
+    expect(await screen.findByRole("status")).toHaveTextContent("Password changed");
+    const [url, init] = fetchMock.mock.calls[0] as unknown as [string, RequestInit];
+    expect(url).toMatch(/\/api\/auth\/password$/);
+    expect((init.headers as Record<string, string>).Authorization).toBe("Bearer tok-123");
+    expect(JSON.parse(init.body as string)).toEqual({
+      currentPassword: "old password!",
+      newPassword: "a brand new passphrase",
+    });
+    expect(onDone).toHaveBeenCalled();
+    expect(getSession()?.token).toBe("tok-123");
+  });
+
+  it("shows the server's message for a wrong current password and keeps the session", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async () => json({ detail: "Current password is incorrect" }, 400)),
+    );
+    render(<ChangePasswordForm />);
+    const user = await fill("wrong", "a brand new passphrase");
+    await user.click(submit());
+    expect(await screen.findByRole("alert")).toHaveTextContent("Current password is incorrect");
+    expect(screen.getByLabelText("Current password")).toHaveValue("");
+    expect(getSession()).not.toBeNull();
+  });
+});
diff --git a/csv-table-hub-main/src/components/change-password.tsx b/csv-table-hub-main/src/components/change-password.tsx
new file mode 100644
index 0000000..a47aa22
--- /dev/null
+++ b/csv-table-hub-main/src/components/change-password.tsx
@@ -0,0 +1,121 @@
+// Change your own password from the header (#117).
+import { useState, type FormEvent } from "react";
+import { KeyRound } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import {
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  DialogTrigger,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { changePassword, MIN_PASSWORD } from "@/lib/session";
+
+export function ChangePasswordForm({ onDone }: { onDone?: () => void }) {
+  const [current, setCurrent] = useState("");
+  const [next, setNext] = useState("");
+  const [confirm, setConfirm] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [done, setDone] = useState(false);
+  const [busy, setBusy] = useState(false);
+
+  const mismatch = confirm !== "" && next !== confirm;
+  const short = next !== "" && next.length < MIN_PASSWORD;
+
+  async function onSubmit(e: FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setBusy(true);
+    try {
+      await changePassword(current, next);
+      setDone(true);
+      setCurrent("");
+      setNext("");
+      setConfirm("");
+      onDone?.();
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setCurrent("");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  if (done) {
+    return (
+      <p role="status" className="text-sm">
+        Password changed. You're still signed in here; any other sessions have been signed out.
+      </p>
+    );
+  }
+
+  return (
+    <form onSubmit={onSubmit} noValidate className="space-y-4">
+      <div className="space-y-2">
+        <Label htmlFor="current-password">Current password</Label>
+        <Input
+          id="current-password"
+          type="password"
+          autoComplete="current-password"
+          value={current}
+          onChange={(e) => setCurrent(e.target.value)}
+        />
+      </div>
+      <div className="space-y-2">
+        <Label htmlFor="new-password">New password</Label>
+        <Input
+          id="new-password"
+          type="password"
+          autoComplete="new-password"
+          value={next}
+          onChange={(e) => setNext(e.target.value)}
+        />
+        {short && (
+          <p className="text-xs text-muted-foreground">At least {MIN_PASSWORD} characters.</p>
+        )}
+      </div>
+      <div className="space-y-2">
+        <Label htmlFor="confirm-password">Confirm new password</Label>
+        <Input
+          id="confirm-password"
+          type="password"
+          autoComplete="new-password"
+          value={confirm}
+          onChange={(e) => setConfirm(e.target.value)}
+        />
+        {mismatch && <p className="text-xs text-destructive">The new passwords don't match.</p>}
+      </div>
+      {error && (
+        <p role="alert" className="text-sm text-destructive">
+          {error}
+        </p>
+      )}
+      <DialogFooter>
+        <Button type="submit" disabled={busy || !current || short || !next || next !== confirm}>
+          Change password
+        </Button>
+      </DialogFooter>
+    </form>
+  );
+}
+
+export function ChangePasswordDialog() {
+  return (
+    <Dialog>
+      <DialogTrigger asChild>
+        <Button variant="ghost" size="sm" aria-label="Change password">
+          <KeyRound className="h-4 w-4" />
+        </Button>
+      </DialogTrigger>
+      <DialogContent className="max-w-sm">
+        <DialogHeader>
+          <DialogTitle>Change password</DialogTitle>
+        </DialogHeader>
+        <ChangePasswordForm />
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/csv-table-hub-main/src/components/session-menu.tsx b/csv-table-hub-main/src/components/session-menu.tsx
index b2a8e4a..7308b21 100644
--- a/csv-table-hub-main/src/components/session-menu.tsx
+++ b/csv-table-hub-main/src/components/session-menu.tsx
@@ -1,8 +1,9 @@
-// Signed-in user, tenant and role, with sign-out (#96).
+// Signed-in user, tenant and role, with change password (#117) and sign-out (#96).
 import { useNavigate } from "@tanstack/react-router";
 import { LogOut } from "lucide-react";
 import { Button } from "@/components/ui/button";
 import { getSession, signOut } from "@/lib/session";
+import { ChangePasswordDialog } from "@/components/change-password";
 
 export function SessionMenu() {
   const navigate = useNavigate();
@@ -13,6 +14,7 @@ export function SessionMenu() {
       <span title={`Role: ${s.role}`}>
         {s.username} · {s.tenant}
       </span>
+      <ChangePasswordDialog />
       <Button
         variant="ghost"
         size="sm"
diff --git a/csv-table-hub-main/src/lib/session.ts b/csv-table-hub-main/src/lib/session.ts
index 7729d46..0dfa0e2 100644
--- a/csv-table-hub-main/src/lib/session.ts
+++ b/csv-table-hub-main/src/lib/session.ts
@@ -89,3 +89,25 @@ export function authHeaders(): Record<string, string> {
 export function requireSession(): void {
   if (!getSession()) throw redirect({ to: "/auth" });
 }
+
+/** Change your own password (#117). This session stays; the server ends all others. */
+export async function changePassword(currentPassword: string, newPassword: string): Promise<void> {
+  const res = await fetch(`${apiBase}/api/auth/password`, {
+    method: "POST",
+    headers: { "content-type": "application/json", ...authHeaders() },
+    body: JSON.stringify({ currentPassword, newPassword }),
+  });
+  if (res.ok) return;
+  const body = await res.json().catch(() => ({}));
+  if (res.status === 401) {
+    clearSession();
+    throw new Error("Your session has ended. Sign in again.");
+  }
+  throw new Error(
+    res.status === 422
+      ? `The new password must be at least ${MIN_PASSWORD} characters`
+      : (body?.detail ?? res.statusText),
+  );
+}
+
+export const MIN_PASSWORD = 12;
diff --git a/docs/QUICKSTART.md b/docs/QUICKSTART.md
index 7b1462c..72e7ff4 100644
--- a/docs/QUICKSTART.md
+++ b/docs/QUICKSTART.md
@@ -118,6 +118,21 @@ It prompts for a password of at least 12 characters, or reads it from
 `TE_ADMIN_PASSWORD`. Sign in with tenant `dev`, username `admin` and that
 password.
 
+### Change or reset a password (#117)
+
+- **Your own password:** sign in, then click the key icon in the header.
+- **Someone else in your tenant:** a tenant admin calls
+  `POST /api/auth/users/<username>/password` (see `docs/ROLES.md`).
+- **No admin can sign in** (forgotten password or locked out):
+
+```powershell
+cd "C:\Users\User\OneDrive\Desktop\Migration using ai\PostgreDataMigrationAppWithCSVLoader"
+python scripts\reset_password.py --username admin
+```
+
+It prompts for the new password (at least 12 characters), or reads it from
+`TE_NEW_PASSWORD`. It also clears any lockout and signs the user out everywhere.
+
 ---
 
 ## 6. Start the frontend (Terminal 2)
diff --git a/docs/ROLES.md b/docs/ROLES.md
index 2ee8c21..366b089 100644
--- a/docs/ROLES.md
+++ b/docs/ROLES.md
@@ -11,10 +11,13 @@ Every member of a tenant has one role (ADR-0003). This table is enforced by `PER
 | list_te | `GET /api/te/tables` | ✓ | ✓ | ✓ | ✓ |
 | delete_file | `DELETE /api/csv/files/{id}` | | | ✓ | |
 | read_audit | `GET /api/audit/log` | | | ✓ | ✓ |
+| reset_password | `POST /api/auth/users/{username}/password` | | | ✓ | |
 
 A role that isn't allowed gets **403**. Two kinds of request are outside this table:
 
-- **Sign-in routes** (`/api/auth/*`) are open to anyone, so people can sign in.
+- **Sign-in routes** (`/api/auth/login`, `/oidc`, `/logout`, `/me`) are open to anyone, so people can sign in. Any signed-in user can change their own password (`POST /api/auth/password`).
 - **Requests with no session** use the shared API key, or nothing in `dev`. They keep full access until the shared key is retired.
 
+**Password reset (#117).** A tenant admin can reset the password of a member of their own tenant. The reset also unlocks the account, ends all of its sessions, and is written to the tenant's audit log. A user who also belongs to another tenant can't be reset this way (409), because the password is shared across tenants. For that case, or when no admin can sign in, an operator with database access runs `scripts/reset_password.py`. Requests with no session can't reset passwords.
+
 Approving and editing data arrive with M4 and M6. The reviewer gets those permissions then.
diff --git a/docs/VCRM.md b/docs/VCRM.md
index c2493d1..69f6b33 100644
--- a/docs/VCRM.md
+++ b/docs/VCRM.md
@@ -154,7 +154,7 @@ Status as assessed on 2026-10-26 at `main` 032b522. None of these is "Verified"
 | BR-33 | ⚠️ Partial | Single-transaction load; no staging or lineage | Integration incl. failure injection | M6 |
 | BR-34 | ⚠️ Partial | Total, inserted, duplicate and failed counts persisted per import (M1: #90, `tests/test_import_counts.py`); over-wide rows reported, not dropped (M1: #88, `tests/test_ragged_rows.py`); excluded and edited rows not yet tracked (M6) | Integration | M1, M6 |
 | BR-35 | ⚠️ Partial | Export formula injection neutralised (M1: #86, `export.test.ts`); audit table still plain, no actor, no filters | DB negative tests + unit | M1, M3, M7 |
-| BR-36 | ⚠️ Partial | Backend done in M2:<br>• local accounts with lockout (#98, #103)<br>• OIDC (#105)<br>• per-tenant schemas, T&E tables included (#100, #104)<br>• role matrix in `docs/ROLES.md` (#101)<br><br>Tests: `tests/test_accounts.py`, `test_tenant_isolation.py`, `test_roles.py`, `test_oidc.py`. Each failed with its control removed.<br><br>Open: frontend sign-in (#96); the shared key still grants non-tenant access until it is retired from the browser | Cross-tenant negative tests; role matrix tests | M2 |
+| BR-36 | ⚠️ Partial | Done in M2:<br>• local accounts with lockout (#98, #103)<br>• OIDC (#105)<br>• per-tenant schemas, T&E tables included (#100, #104)<br>• role matrix in `docs/ROLES.md` (#101)<br><br>Tests: `tests/test_accounts.py`, `test_tenant_isolation.py`, `test_roles.py`, `test_oidc.py`, `test_password_reset.py`. Each failed with its control removed.<br>• frontend sign-in; the browser no longer holds the shared key (#115)<br>• password change, admin reset and break-glass reset (#117; `tests/test_password_reset.py`)<br><br>Open: the shared key still grants non-tenant access to scripts and services; security review (#112); real-IdP OIDC check (#113) | Cross-tenant negative tests; role matrix tests | M2 |
 | BR-37 | ⚠️ Partial | No external calls found; no automated check; no offline doc (#60) | Egress-blocked run + offline dry run | M7 |
 
 ---
diff --git a/docs/offline-install.md b/docs/offline-install.md
index 15c1559..7eec83b 100644
--- a/docs/offline-install.md
+++ b/docs/offline-install.md
@@ -112,7 +112,11 @@ Once that evidence is on #60, the README can move to the "fully offline" wording
 ## Known limits
 
 - **Fresh VM only.** Re-running `install.sh` replaces `/opt/te-migration`. The database script has only been run against an empty database.
-- **Change the first admin's password.** The installer generates it. There's no self-service password change yet, so rerun `scripts/create_tenant_admin.py` for a new admin if needed.
+- **Change the first admin's password.** The installer generates it. Sign in and change it with the key icon in the header. If it's lost, reset it on the VM (bash, as root). This is the same way the installer runs its admin script:
+  ```bash
+  cd /opt/te-migration/app
+  sudo bash -c 'set -a; . /opt/te-migration/env; set +a; runuser -u te-app -- /opt/te-migration/venv/bin/python scripts/reset_password.py --username admin'
+  ```
 - **The API address is fixed at install.** It's written into the frontend files. To change it, re-run the install.
 - **Ubuntu 24.04 x86_64 only.** Other operating systems need different packages and wheels.
 
diff --git a/scripts/reset_password.py b/scripts/reset_password.py
new file mode 100644
index 0000000..cf296bf
--- /dev/null
+++ b/scripts/reset_password.py
@@ -0,0 +1,49 @@
+"""Break-glass password reset for a local account (#117).
+
+For an operator with database access, when no tenant admin can sign in. It sets
+the password, clears any lockout (#102) and ends all of the user's sessions.
+Run from the repo root with the API's PG* environment set:
+    python scripts/reset_password.py --username alice
+
+The new password is read from TE_NEW_PASSWORD if set, otherwise prompted for.
+"""
+
+from __future__ import annotations
+
+import argparse
+import getpass
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from api import db  # noqa: E402
+from api.services import accounts  # noqa: E402
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--username", required=True)
+    args = ap.parse_args(argv)
+    password = os.environ.get("TE_NEW_PASSWORD") or getpass.getpass(f"New password for {args.username}: ")
+    if len(password) < accounts.MIN_PASSWORD:
+        print(f"Password must be at least {accounts.MIN_PASSWORD} characters.", file=sys.stderr)
+        return 2
+    db.init_pool()
+    try:
+        with db.Conn() as conn:
+            with conn.cursor() as cur:
+                found = accounts.set_password(cur, args.username, password)
+            conn.commit()
+    finally:
+        db.close_pool()
+    if not found:
+        print(f"No user '{args.username}'.", file=sys.stderr)
+        return 1
+    print(f"Password reset for '{args.username}'; lockout cleared and all sessions ended.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/tests/test_api_hardening.py b/tests/test_api_hardening.py
index 411b601..50e6054 100644
--- a/tests/test_api_hardening.py
+++ b/tests/test_api_hardening.py
@@ -191,7 +191,7 @@ class AuditWriterContract(unittest.TestCase):
     """O-04: the shared audit writer's guardrails, without touching a database."""
 
     def test_only_known_actions_are_accepted(self):
-        self.assertEqual(VALID_ACTIONS, {"upload", "delete"})
+        self.assertEqual(VALID_ACTIONS, {"upload", "delete", "password_reset"})
 
     def test_unknown_action_raises_before_any_sql_runs(self):
         class ExplodingCursor:
diff --git a/tests/test_password_reset.py b/tests/test_password_reset.py
new file mode 100644
index 0000000..7e675fc
--- /dev/null
+++ b/tests/test_password_reset.py
@@ -0,0 +1,155 @@
+"""Password change, admin reset and break-glass reset for local accounts (#117).
+
+Integration tests over a live PostgreSQL; they fail, never skip, without one.
+"""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+import uuid
+from pathlib import Path
+
+import pytest
+from psycopg2 import sql
+
+from api.config import settings
+from api.db import Conn
+from api.services import accounts
+from api.tenancy import migrate_tenant, schema_for
+from tests.test_accounts import _PW, _Accounts
+
+_NEW = "a brand new passphrase"
+_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _bearer(token: str) -> dict:
+    return {"Authorization": f"Bearer {token}"}
+
+
+@pytest.mark.integration
+class ChangeOwnPassword(_Accounts):
+    def _change(self, token: str, current=_PW, new=_NEW):
+        return self.client.post("/api/auth/password", headers=_bearer(token),
+                                json={"currentPassword": current, "newPassword": new})
+
+    def test_new_password_works_old_does_not_and_other_sessions_end(self):
+        mine, other = self._login().json()["token"], self._login().json()["token"]
+        self.assertEqual(self._change(mine).status_code, 200)
+        self.assertEqual(self._login().status_code, 401, "old password must stop working")
+        self.assertEqual(self._login(password=_NEW).status_code, 200)
+        self.assertEqual(self._me(mine).status_code, 200, "this session stays signed in")
+        self.assertEqual(self._me(other).status_code, 401, "other sessions must end")
+
+    def test_wrong_current_password_is_400_changes_nothing_and_counts_as_a_failure(self):
+        token = self._login().json()["token"]
+        res = self._change(token, current="wrong")
+        self.assertEqual((res.status_code, res.json()["detail"]), (400, "Current password is incorrect"))
+        self.assertEqual(self._me(token).status_code, 200)
+        with Conn() as conn, conn.cursor() as cur:
+            cur.execute(sql.SQL("SELECT failed_logins FROM {}.users WHERE id = %s").format(
+                sql.Identifier(settings.CONTROL_SCHEMA)), (self.user_id,))
+            self.assertEqual(cur.fetchone()[0], 1)
+        self.assertEqual(self._login().status_code, 200, "password unchanged")
+
+    def test_short_new_password_is_rejected(self):
+        token = self._login().json()["token"]
+        self.assertEqual(self._change(token, new="x" * (accounts.MIN_PASSWORD - 1)).status_code, 422)
+        self.assertEqual(self._login().status_code, 200)
+
+    def test_needs_a_session(self):
+        res = self.client.post("/api/auth/password", json={"currentPassword": _PW, "newPassword": _NEW})
+        self.assertEqual(res.status_code, 401)
+
+
+@pytest.mark.integration
+class AdminReset(_Accounts):
+    def setUp(self):
+        super().setUp()
+        self.admin = f"admin_{uuid.uuid4().hex[:8]}"
+        with Conn() as conn:
+            with conn.cursor() as cur:
+                cur.execute(sql.SQL("SELECT id FROM {}.tenants WHERE slug = %s").format(
+                    sql.Identifier(settings.CONTROL_SCHEMA)), (self.tenant,))
+                self.tenant_id = cur.fetchone()[0]
+                accounts.add_membership(cur, accounts.create_user(cur, self.admin, _PW),
+                                        self.tenant_id, "tenant_admin")
+            conn.commit()
+        migrate_tenant(self.tenant)  # real tenants always have their schema (audit_log lives there)
+        self.admin_token = self._login(username=self.admin).json()["token"]
+
+    def tearDown(self):
+        with Conn() as conn:
+            with conn.cursor() as cur:
+                cur.execute(sql.SQL("DROP SCHEMA IF EXISTS {} CASCADE").format(
+                    sql.Identifier(schema_for(self.tenant))))
+            conn.commit()
+
+    def _reset(self, username: str, token: str | None = None):
+        return self.client.post(f"/api/auth/users/{username}/password",
+                                headers=_bearer(token or self.admin_token), json={"newPassword": _NEW})
+
+    def test_admin_reset_sets_password_unlocks_and_ends_the_users_sessions(self):
+        user_token = self._login().json()["token"]
+        self._exec("UPDATE {c}.users SET locked_until = now() + interval '1 hour' WHERE id = %s", self.user_id)
+        self.assertEqual(self._reset(self.user).status_code, 200)
+        self.assertEqual(self._me(user_token).status_code, 401, "the user's sessions must end")
+        self.assertEqual(self._login().status_code, 401, "old password must stop working")
+        self.assertEqual(self._login(password=_NEW).status_code, 200, "new password works and lock is cleared")
+
+    def test_reset_is_written_to_the_tenants_audit_log(self):
+        self.assertEqual(self._reset(self.user).status_code, 200)
+        with Conn() as conn, conn.cursor() as cur:
+            cur.execute(sql.SQL("SELECT action, file_name, mode FROM {}.audit_log").format(
+                sql.Identifier(schema_for(self.tenant))))
+            self.assertEqual(cur.fetchall(), [("password_reset", self.user, f"by {self.admin}")])
+
+    def test_non_admin_cannot_reset(self):
+        user_token = self._login().json()["token"]
+        self.assertEqual(self._reset(self.admin, token=user_token).status_code, 403)
+        self.assertEqual(self._login(username=self.admin).status_code, 200, "admin password unchanged")
+
+    def test_admin_cannot_reset_a_user_in_another_tenant(self):
+        outsider = f"out_{uuid.uuid4().hex[:8]}"
+        with Conn() as conn:
+            with conn.cursor() as cur:
+                cur.execute(sql.SQL("SELECT id FROM {}.tenants WHERE slug = %s").format(
+                    sql.Identifier(settings.CONTROL_SCHEMA)), (self.other,))
+                tid = cur.fetchone()[0]
+                accounts.add_membership(cur, accounts.create_user(cur, outsider, _PW), tid, "uploader")
+            conn.commit()
+        self.assertEqual(self._reset(outsider).status_code, 404)
+        self.assertEqual(self._login(tenant=self.other, username=outsider).status_code, 200)
+
+    def test_user_who_is_also_in_another_tenant_is_refused(self):
+        with Conn() as conn:
+            with conn.cursor() as cur:
+                cur.execute(sql.SQL("SELECT id FROM {}.tenants WHERE slug = %s").format(
+                    sql.Identifier(settings.CONTROL_SCHEMA)), (self.other,))
+                accounts.add_membership(cur, self.user_id, cur.fetchone()[0], "uploader")
+            conn.commit()
+        self.assertEqual(self._reset(self.user).status_code, 409)
+        self.assertEqual(self._login().status_code, 200, "password unchanged")
+
+
+@pytest.mark.integration
+class BreakGlassReset(_Accounts):
+    def _run(self, username: str, password: str = _NEW) -> subprocess.CompletedProcess:
+        return subprocess.run([sys.executable, "scripts/reset_password.py", "--username", username],
+                              cwd=_ROOT, env={**os.environ, "TE_NEW_PASSWORD": password},
+                              capture_output=True, text=True, timeout=60)
+
+    def test_resets_password_clears_lockout_and_ends_sessions(self):
+        token = self._login().json()["token"]
+        self._exec("UPDATE {c}.users SET locked_until = now() + interval '1 hour' WHERE id = %s", self.user_id)
+        res = self._run(self.user)
+        self.assertEqual(res.returncode, 0, res.stderr)
+        self.assertEqual(self._me(token).status_code, 401)
+        self.assertEqual(self._login().status_code, 401)
+        self.assertEqual(self._login(password=_NEW).status_code, 200)
+
+    def test_unknown_user_and_short_password_fail_without_changes(self):
+        self.assertEqual(self._run("nobody_" + uuid.uuid4().hex).returncode, 1)
+        self.assertEqual(self._run(self.user, password="short").returncode, 2)
+        self.assertEqual(self._login().status_code, 200)
diff --git a/tests/test_roles.py b/tests/test_roles.py
index fb60dd7..553d32d 100644
--- a/tests/test_roles.py
+++ b/tests/test_roles.py
@@ -34,6 +34,7 @@
     "list_te": ("GET", "/api/te/tables"),
     "delete_file": ("DELETE", "/api/csv/files/{id}"),
     "read_audit": ("GET", "/api/audit/log"),
+    "reset_password": ("POST", "/api/auth/users/{user}/password"),
 }
 
 
@@ -105,11 +106,22 @@ def _file(self) -> tuple[str, str]:
     def _call(self, role: str, action: str) -> int:
         method, path = _ROUTES[action]
         table, file_id = self._file()
-        body = None
+        body, user = None, None
         if action in ("preview", "upload"):
             tag = uuid.uuid4().hex[:10]
             body = {"fileName": f"p_{tag}.csv", "content": f"k\n{tag}\n"}
-        res = self.client.request(method, path.format(table=table, id=file_id),
+        if action == "reset_password":
+            # A fresh member to reset, so no role's own session is revoked mid-test.
+            user = f"{self.slug}_t{uuid.uuid4().hex[:6]}"
+            with Conn() as conn:
+                with conn.cursor() as cur:
+                    cur.execute(sql.SQL("SELECT id FROM {}.tenants WHERE slug = %s").format(
+                        sql.Identifier(settings.CONTROL_SCHEMA)), (self.slug,))
+                    tid = cur.fetchone()[0]
+                    accounts.add_membership(cur, accounts.create_user(cur, user, _PW), tid, "uploader")
+                conn.commit()
+            body = {"newPassword": "a brand new passphrase"}
+        res = self.client.request(method, path.format(table=table, id=file_id, user=user),
                                   headers=self.headers[role], json=body)
         return res.status_code