diff --git a/src/Handler/Utils/Avs.hs b/src/Handler/Utils/Avs.hs
index ce86e627d..42275f139 100644
--- a/src/Handler/Utils/Avs.hs
+++ b/src/Handler/Utils/Avs.hs
@@ -494,7 +494,7 @@ upsertAvsUserById api = do
         whenIsJust pinCard $ \pCard -> -- update pin, but only if it was unset or set to the value of an old card
           unlessM (exists [UserAvsCardCardNo ==. getFullCardNo pCard]) $ do
             let oldPins = Just . personCard2pin . userAvsCardCard . entityVal <$> oldCards
-            updateWhere [UserId ==. uid, UserPinPassword !=. userPin, UserPinPassword <-. Nothing:oldPins]
+            updateWhere [UserId ==. uid, UserPinPassword !=. userPin, UserPinPassword <-. oldPins] -- check for old pin ensures that unset/manually set passwords remain unchanged
                         [UserPinPassword =. userPin]
             insert_ $ UserAvsCard api (getFullCardNo pCard) pCard now
         upsertUserCompany uid mbCompany userFirmAddr