diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 35cc51d5b1a9ab8dcca4e6503d8c1818597d7081..a46793f6b4c4c58f3dfa65b749027a29bc0e1959 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -21,6 +21,7 @@ Added
 * Allow configuring regex for allowed usernames
 * [Dev] Support scheduled notifications.
 * Implement StaticContentWidget
+* Allow to enable password change independently of password reset
 
 Changed
 ~~~~~~~
diff --git a/aleksis/core/preferences.py b/aleksis/core/preferences.py
index 352d5480d179189ad1c92ffd9d44c69fb63732af..78b1874356a3a11eab121a56963c9aaf3595d872 100644
--- a/aleksis/core/preferences.py
+++ b/aleksis/core/preferences.py
@@ -271,6 +271,14 @@ class AllowPasswordChange(BooleanPreference):
     verbose_name = _("Allow users to change their passwords")
 
 
+@site_preferences_registry.register
+class AllowPasswordReset(BooleanPreference):
+    section = auth
+    name = "allow_password_reset"
+    default = True
+    verbose_name = _("Allow users to reset their passwords")
+
+
 @site_preferences_registry.register
 class SignupEnabled(BooleanPreference):
     section = auth
diff --git a/aleksis/core/templates/two_factor/core/login.html b/aleksis/core/templates/two_factor/core/login.html
index 819b209979796b358538d22dcf89cf07abec0cbf..77b135569d797181a45bd49d7fd7e9cded4e9a5c 100644
--- a/aleksis/core/templates/two_factor/core/login.html
+++ b/aleksis/core/templates/two_factor/core/login.html
@@ -95,7 +95,7 @@
               {% trans "Login" %}
               <i class="material-icons right">send</i>
             </button>
-            {% if request.site.preferences.auth__allow_password_change and wizard.steps.current == "auth" %}
+            {% if request.site.preferences.auth__allow_password_reset and wizard.steps.current == "auth" %}
               <a href="{% url "account_reset_password" %}" class="btn-flat right waves-effect waves-red">
                 {% trans "Reset password" %}
               </a>