diff --git a/openldap/self-service-passwords.yaml b/openldap/self-service-passwords.yaml
index cf30bcd..fbd54ed 100644
--- a/openldap/self-service-passwords.yaml
+++ b/openldap/self-service-passwords.yaml
@@ -32,6 +32,7 @@ data:
     $show_help = true;
 
     # Enable Samba password updates
+    $who_change_password = "manager";
     $samba_mode = true;
 
     # Optional: also maintain Samba password age attributes