diff --git a/src/actions/admin.ts b/src/actions/admin.ts
index 511a010..5e32bf9 100644
--- a/src/actions/admin.ts
+++ b/src/actions/admin.ts
@@ -24,7 +24,7 @@ export const admin = {
     input: z.object({
       id: z.number(),
       username: z.string(),
-      password: z.string(),
+      password: z.string().nullable(),
       permissions: z.number()
     }),
     handler: async (input, context) => {
diff --git a/src/app/admin/admins/Admins.svelte b/src/app/admin/admins/Admins.svelte
index bfc6fc0..9db95ec 100644
--- a/src/app/admin/admins/Admins.svelte
+++ b/src/app/admin/admins/Admins.svelte
@@ -32,7 +32,7 @@
       </tr>
     </thead>
     <tbody>
-      {#each $admins as admin, i (admin.id)}
+      {#each $admins as admin, i (admin)}
         <tr class="hover:bg-base-200">
           <td>{i + 1}</td>
           <td>{admin.username}</td>
diff --git a/src/app/admin/admins/Badges.svelte b/src/app/admin/admins/Badges.svelte
index 26e1b6d..e6c268a 100644
--- a/src/app/admin/admins/Badges.svelte
+++ b/src/app/admin/admins/Badges.svelte
@@ -23,6 +23,7 @@
     const index = reactiveSet.indexOf(badge);
     if (index !== -1) {
       reactiveSet.splice(index, 1);
+      onUpdate?.(reactiveSet);
     }
   }
 </script>
diff --git a/src/app/admin/admins/CreateOrEditPopup.svelte b/src/app/admin/admins/CreateOrEditPopup.svelte
index 768a508..93ae2fa 100644
--- a/src/app/admin/admins/CreateOrEditPopup.svelte
+++ b/src/app/admin/admins/CreateOrEditPopup.svelte
@@ -44,7 +44,7 @@
   let password = $state<string | null>(null);
   let permissions = $state<number | null>(admin?.permissions ?? 0);
 
-  let submitEnabled = $derived(!!(username && password));
+  let submitEnabled = $derived(!!username && (admin || password));
 
   // lifecycle
   $effect(() => {
@@ -85,7 +85,7 @@
       <div class="w-full gap-x-4 gap-y-2">
         <div class="w-[20rem]">
           <Input type="text" bind:value={username} label="Username" required />
-          <Password bind:value={password} label="Password" required />
+          <Password bind:value={password} label="Password" required={!admin} />
         </div>
         <fieldset class="fieldset">
           <legend class="fieldset-legend">Berechtigungen</legend>
diff --git a/src/db/schema/admin.ts b/src/db/schema/admin.ts
index 61577bc..ad5a946 100644
--- a/src/db/schema/admin.ts
+++ b/src/db/schema/admin.ts
@@ -15,7 +15,12 @@ export const admin = mysqlTable('admin', {
 
 export type AddAdminReq = Omit<typeof admin.$inferInsert, 'id'>;
 
-export type EditAdminReq = Omit<typeof admin.$inferInsert, 'id'> & { id: number };
+export type EditAdminReq = {
+  id: number;
+  username: string;
+  password: string | null;
+  permissions: number;
+};
 
 export type GetAdminReq = {};
 export type GetAdminRes = Omit<typeof admin.$inferSelect, 'password'>[];
@@ -39,9 +44,15 @@ export async function addAdmin(db: Database, values: AddAdminReq) {
 }
 
 export async function editAdmin(db: Database, values: EditAdminReq) {
-  values.password = bcrypt.hashSync(values.password, 10);
-
-  await db.update(admin).set(values).where(eq(admin.id, values.id));
+  return db
+    .update(admin)
+    .set({
+      id: values.id,
+      username: values.username,
+      password: values.password != null ? bcrypt.hashSync(values.password, 10) : undefined,
+      permissions: values.permissions
+    })
+    .where(eq(admin.id, values.id));
 }
 
 export async function getAdmins(db: Database, _values: GetAdminReq): Promise<GetAdminRes> {
diff --git a/src/layouts/admin/AdminLayout.astro b/src/layouts/admin/AdminLayout.astro
index d7459e6..26810b5 100644
--- a/src/layouts/admin/AdminLayout.astro
+++ b/src/layouts/admin/AdminLayout.astro
@@ -17,7 +17,7 @@ const session = Session.sessionFromCookies(Astro.cookies);
 
 const preTabs = [
   {
-    href: ``,
+    href: '',
     name: 'Varo Startseite',
     icon: 'heroicons:computer-desktop-20-solid'
   }