diff --git a/lib/admin.js b/lib/admin.js
index 4ec6b3b..1211611 100644
--- a/lib/admin.js
+++ b/lib/admin.js
@@ -120,11 +120,19 @@ async function setupAdmin(app) {
           actions: {
             edit: {
               before: async (request) => {
-                const pw = request.payload?.password?.trim();
-                const pw2 = request.payload?.password_confirm?.trim();
+                const pw = (request.payload?.password || '').trim();
+                const pw2 = (request.payload?.password_confirm || '').trim();
                 if (pw) {
-                  if (pw !== pw2) throw new Error('Пароли не совпадают');
-                  if (pw.length < 6) throw new Error('Пароль минимум 6 символов');
+                  if (pw2 && pw !== pw2) {
+                    request.payload.errors = request.payload.errors || {};
+                    request.payload.errors.password_confirm = { message: 'Пароли не совпадают' };
+                    return request;
+                  }
+                  if (pw.length < 6) {
+                    request.payload.errors = request.payload.errors || {};
+                    request.payload.errors.password = { message: 'Минимум 6 символов' };
+                    return request;
+                  }
                   const bcrypt = require('bcrypt');
                   request.payload.password_hash = await bcrypt.hash(pw, 10);
                 }
@@ -135,11 +143,23 @@ async function setupAdmin(app) {
             },
             new: {
               before: async (request) => {
-                const pw = request.payload?.password?.trim();
-                const pw2 = request.payload?.password_confirm?.trim();
-                if (!pw) throw new Error('Пароль обязателен');
-                if (pw !== pw2) throw new Error('Пароли не совпадают');
-                if (pw.length < 6) throw new Error('Пароль минимум 6 символов');
+                const pw = (request.payload?.password || '').trim();
+                const pw2 = (request.payload?.password_confirm || '').trim();
+                if (!pw) {
+                  request.payload.errors = request.payload.errors || {};
+                  request.payload.errors.password = { message: 'Пароль обязателен' };
+                  return request;
+                }
+                if (pw2 && pw !== pw2) {
+                  request.payload.errors = request.payload.errors || {};
+                  request.payload.errors.password_confirm = { message: 'Пароли не совпадают' };
+                  return request;
+                }
+                if (pw.length < 6) {
+                  request.payload.errors = request.payload.errors || {};
+                  request.payload.errors.password = { message: 'Минимум 6 символов' };
+                  return request;
+                }
                 const bcrypt = require('bcrypt');
                 request.payload.password_hash = await bcrypt.hash(pw, 10);
                 delete request.payload.password;