diff --git a/web/src/main/webapp/META-INF/includes/user/password.xhtml b/web/src/main/webapp/META-INF/includes/user/password.xhtml
index a05e1506a8d5..8d48cbe4737e 100644
--- a/web/src/main/webapp/META-INF/includes/user/password.xhtml
+++ b/web/src/main/webapp/META-INF/includes/user/password.xhtml
@@ -385,7 +385,7 @@
 									actionListener="#{passwordBean.add}"
 									oncomplete="handleUpdateUserTabTitles(xhr, status, args)"
 									icon="ui-icon ui-icon-disk" ajax="true"
-									disabled="#{!passwordBean.createable or (!passwordBean.created and passwordBean.in.enable2fa)}"
+									disabled="#{!passwordBean.createable or ((!passwordBean.created or !passwordBean.out.hasOtpSecret) and passwordBean.in.enable2fa)}"
 									update="password_input,passwordadd_departmentpassword"/>
 									
 								<p:commandButton process="@this,password_input"
@@ -461,7 +461,7 @@
 					onstart="setHiddenField('tabView:password_form:departmentPassword',passwordAddDepartmentPassword.getValue());passwordAddDepartmentPasswordDialog.hide();"
 					oncomplete="handleUpdateUserTabTitles(xhr, status, args)"
 					icon="ui-icon ui-icon-disk" ajax="true"
-					disabled="#{(!passwordBean.created and passwordBean.in.enable2fa)}"
+					disabled="#{((!passwordBean.created or !passwordBean.out.hasOtpSecret) and passwordBean.in.enable2fa)}"
 					update="password_input,passwordadd_departmentpassword" />
 				<p:commandButton process="@this,password_input"
 					id="addPasswordResetOtpSecretDepartment"