diff --git a/libeufin-bank/src/main/kotlin/tech/libeufin/bank/cli/ChangePw.kt b/libeufin-bank/src/main/kotlin/tech/libeufin/bank/cli/ChangePw.kt
index de012c1a..fae2c73b 100644
--- a/libeufin-bank/src/main/kotlin/tech/libeufin/bank/cli/ChangePw.kt
+++ b/libeufin-bank/src/main/kotlin/tech/libeufin/bank/cli/ChangePw.kt
@@ -36,12 +36,19 @@ class ChangePw : TalerCmd("passwd") {
     override fun help(context: Context) = "Change account password"
 
     private val username by argument("username", help = "Account username")
+    // Optional: when omitted we prompt interactively from run(), i.e. only
+    // after the required 'username' argument has been provided and validated.
+    // Prompting from an argument default (defaultLazy) would run during
+    // argument finalization and thus ask for the password even when 'username'
+    // is missing (see bug #10650).
     private val password by argument(
-        "password", 
+        "password",
         help = "Account password used for authentication"
-    ).defaultLazy("prompt") {
+    ).optional()
+
+    private fun promptPassword(): String {
         val terminal = Terminal()
-        ConfirmationPrompt.create(
+        return ConfirmationPrompt.create(
             "Password",
             "Repeat for confirmation",
             "Values do not match, try again",
@@ -58,9 +65,11 @@ class ChangePw : TalerCmd("passwd") {
             }
         ).ask()!!
     }
+
     override fun run() = cliCmd(logger) {
+        val rawPassword = password ?: promptPassword()
         bankConfig(config).withDb { db, cfg ->
-            val password = password.checkPw(cfg.pwdCheckQuality)
+            val password = rawPassword.checkPw(cfg.pwdCheckQuality)
             val res = db.account.reconfigPassword(username, password, null, true, cfg.pwCrypto)
             when (res) {
                 AccountPatchAuthResult.UnknownAccount ->