diff --git a/api/app/Enums/EmailChangeStatus.php b/api/app/Enums/EmailChangeStatus.php
new file mode 100644
index 00000000..009d3539
--- /dev/null
+++ b/api/app/Enums/EmailChangeStatus.php
@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Enums;
+
+enum EmailChangeStatus: string
+{
+    case PENDING = 'pending';
+    case VERIFIED = 'verified';
+    case EXPIRED = 'expired';
+    case CANCELLED = 'cancelled';
+}
diff --git a/api/app/Http/Controllers/Api/V1/AccountController.php b/api/app/Http/Controllers/Api/V1/AccountController.php
new file mode 100644
index 00000000..c67a6c60
--- /dev/null
+++ b/api/app/Http/Controllers/Api/V1/AccountController.php
@@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\Validation\ValidationException;
+
+final class AccountController extends Controller
+{
+    /**
+     * POST /api/v1/me/change-password
+     * Authenticated user changes their own password.
+     */
+    public function changePassword(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'current_password' => ['required'],
+            'password' => ['required', 'confirmed', Password::min(8)->mixedCase()->numbers()],
+        ]);
+
+        $user = $request->user();
+
+        if (! Hash::check($validated['current_password'], $user->password)) {
+            throw ValidationException::withMessages([
+                'current_password' => ['Het huidige wachtwoord is onjuist.'],
+            ]);
+        }
+
+        $user->update([
+            'password' => Hash::make($validated['password']),
+        ]);
+
+        // Revoke all OTHER tokens (keep current session)
+        $currentToken = $user->currentAccessToken();
+        if ($currentToken instanceof \Laravel\Sanctum\PersonalAccessToken) {
+            $user->tokens()->where('id', '!=', $currentToken->id)->delete();
+        } else {
+            // TransientToken (test) or no token — revoke all
+            $user->tokens()->delete();
+        }
+
+        activity()
+            ->causedBy($user)
+            ->performedOn($user)
+            ->log('user.password_changed');
+
+        return $this->success(message: 'Je wachtwoord is succesvol gewijzigd.');
+    }
+}
diff --git a/api/app/Http/Controllers/Api/V1/EmailChangeController.php b/api/app/Http/Controllers/Api/V1/EmailChangeController.php
new file mode 100644
index 00000000..5e73ad63
--- /dev/null
+++ b/api/app/Http/Controllers/Api/V1/EmailChangeController.php
@@ -0,0 +1,71 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use App\Services\EmailChangeService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\ValidationException;
+
+final class EmailChangeController extends Controller
+{
+    public function __construct(private readonly EmailChangeService $service) {}
+
+    /**
+     * POST /api/v1/me/change-email
+     * User requests to change their own email.
+     */
+    public function request(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'new_email' => ['required', 'email', 'max:255'],
+            'password' => ['required'],
+            'app' => ['required', 'in:app,portal,admin'],
+        ]);
+
+        // Verify current password
+        if (! Hash::check($validated['password'], $request->user()->password)) {
+            throw ValidationException::withMessages([
+                'password' => ['Het huidige wachtwoord is onjuist.'],
+            ]);
+        }
+
+        $frontendUrls = [
+            'admin' => config('app.frontend_admin_url'),
+            'app' => config('app.frontend_app_url'),
+            'portal' => config('app.frontend_portal_url'),
+        ];
+
+        $this->service->requestChange(
+            $request->user(),
+            $validated['new_email'],
+            $request->user(),
+            $frontendUrls[$validated['app']],
+        );
+
+        return $this->success(
+            message: 'Er is een verificatiemail verstuurd naar ' . $validated['new_email'] . '.',
+        );
+    }
+
+    /**
+     * POST /api/v1/verify-email-change
+     * Public endpoint — verifies the token from the email link.
+     */
+    public function verify(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'token' => ['required', 'string'],
+        ]);
+
+        $this->service->verifyChange($validated['token']);
+
+        return $this->success(
+            message: 'Je e-mailadres is succesvol gewijzigd.',
+        );
+    }
+}
diff --git a/api/app/Http/Controllers/Api/V1/MemberController.php b/api/app/Http/Controllers/Api/V1/MemberController.php
index 62789c54..127bd1ba 100644
--- a/api/app/Http/Controllers/Api/V1/MemberController.php
+++ b/api/app/Http/Controllers/Api/V1/MemberController.php
@@ -10,7 +10,9 @@ use App\Http\Resources\Api\V1\MemberCollection;
 use App\Http\Resources\Api\V1\MemberResource;
 use App\Models\Organisation;
 use App\Models\User;
+use App\Services\EmailChangeService;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Gate;
 
 final class MemberController extends Controller
@@ -81,4 +83,30 @@ final class MemberController extends Controller
 
         return response()->json(null, 204);
     }
+
+    /**
+     * POST /api/v1/organisations/{organisation}/members/{user}/change-email
+     * Admin changes a member's email (sends verification to new address).
+     */
+    public function changeEmail(Request $request, Organisation $organisation, User $user): JsonResponse
+    {
+        Gate::authorize('invite', $organisation);
+
+        $validated = $request->validate([
+            'new_email' => ['required', 'email', 'max:255'],
+        ]);
+
+        $frontendUrl = config('app.frontend_app_url');
+
+        app(EmailChangeService::class)->requestChange(
+            $user,
+            $validated['new_email'],
+            $request->user(),
+            $frontendUrl,
+        );
+
+        return $this->success(
+            message: 'Er is een verificatiemail verstuurd naar ' . $validated['new_email'] . '.',
+        );
+    }
 }
diff --git a/api/app/Http/Controllers/Api/V1/PasswordResetController.php b/api/app/Http/Controllers/Api/V1/PasswordResetController.php
index a852f83e..6173c347 100644
--- a/api/app/Http/Controllers/Api/V1/PasswordResetController.php
+++ b/api/app/Http/Controllers/Api/V1/PasswordResetController.php
@@ -5,6 +5,8 @@ declare(strict_types=1);
 namespace App\Http\Controllers\Api\V1;
 
 use App\Http\Controllers\Controller;
+use App\Models\User;
+use App\Notifications\ResetPasswordNotification;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
@@ -15,34 +17,57 @@ final class PasswordResetController extends Controller
 {
     public function sendResetLink(Request $request): JsonResponse
     {
-        $request->validate(['email' => 'required|email']);
+        $request->validate([
+            'email' => ['required', 'email'],
+            'app' => ['required', 'in:app,portal,admin'],
+        ]);
 
-        Password::sendResetLink(['email' => strtolower($request->email)]);
+        $frontendUrls = [
+            'admin' => config('app.frontend_admin_url'),
+            'app' => config('app.frontend_app_url'),
+            'portal' => config('app.frontend_portal_url'),
+        ];
+
+        $frontendUrl = $frontendUrls[$request->input('app')];
+
+        Password::sendResetLink(
+            ['email' => strtolower($request->email)],
+            function (User $user, string $token) use ($frontendUrl) {
+                $user->notify(new ResetPasswordNotification($token, $frontendUrl));
+            }
+        );
 
         // Always return success (don't leak whether email exists)
         return $this->success(
-            message: 'Als dit emailadres bij ons bekend is, ontvang je een link om je wachtwoord te resetten.'
+            message: 'Als dit e-mailadres bij ons bekend is, ontvang je een link om je wachtwoord te herstellen.'
         );
     }
 
     public function resetPassword(Request $request): JsonResponse
     {
         $request->validate([
-            'token' => 'required',
-            'email' => 'required|email',
+            'token' => ['required'],
+            'email' => ['required', 'email'],
             'password' => ['required', 'confirmed', PasswordRule::min(8)->mixedCase()->numbers()],
         ]);
 
         $status = Password::reset(
             $request->only('email', 'password', 'password_confirmation', 'token'),
-            function ($user, $password) {
+            function (User $user, string $password) {
                 $user->forceFill(['password' => Hash::make($password)])->save();
+
+                // Revoke all existing tokens (force re-login everywhere)
                 $user->tokens()->delete();
+
+                activity()
+                    ->causedBy($user)
+                    ->performedOn($user)
+                    ->log('user.password_reset');
             }
         );
 
         if ($status === Password::PASSWORD_RESET) {
-            return $this->success(message: 'Wachtwoord succesvol gewijzigd.');
+            return $this->success(message: 'Je wachtwoord is succesvol gewijzigd. Je kunt nu inloggen.');
         }
 
         return $this->error(__($status), 422);
diff --git a/api/app/Mail/EmailChangedConfirmationMail.php b/api/app/Mail/EmailChangedConfirmationMail.php
new file mode 100644
index 00000000..afe5e168
--- /dev/null
+++ b/api/app/Mail/EmailChangedConfirmationMail.php
@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mail;
+
+use App\Models\User;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+final class EmailChangedConfirmationMail extends Mailable implements ShouldQueue
+{
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public User $user,
+        public string $oldEmail,
+        public string $newEmail,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            subject: 'Je e-mailadres is gewijzigd — Crewli',
+        );
+    }
+
+    public function content(): Content
+    {
+        return new Content(
+            markdown: 'emails.email-changed-confirmation',
+            with: [
+                'userName' => $this->user->first_name,
+                'newEmail' => $this->newEmail,
+            ],
+        );
+    }
+}
diff --git a/api/app/Mail/VerifyEmailChangeMail.php b/api/app/Mail/VerifyEmailChangeMail.php
new file mode 100644
index 00000000..60804e66
--- /dev/null
+++ b/api/app/Mail/VerifyEmailChangeMail.php
@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Mail;
+
+use App\Models\User;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+final class VerifyEmailChangeMail extends Mailable implements ShouldQueue
+{
+    use Queueable;
+    use SerializesModels;
+
+    public function __construct(
+        public User $user,
+        public string $newEmail,
+        public string $token,
+        public string $frontendUrl,
+        public User $requestedBy,
+    ) {}
+
+    public function envelope(): Envelope
+    {
+        return new Envelope(
+            subject: 'Bevestig je nieuwe e-mailadres — Crewli',
+        );
+    }
+
+    public function content(): Content
+    {
+        $verifyUrl = $this->frontendUrl . '/verify-email-change?token=' . $this->token;
+        $isSelfChange = $this->user->id === $this->requestedBy->id;
+
+        return new Content(
+            markdown: 'emails.verify-email-change',
+            with: [
+                'verifyUrl' => $verifyUrl,
+                'userName' => $this->user->first_name,
+                'isSelfChange' => $isSelfChange,
+                'requestedByName' => $this->requestedBy->full_name,
+            ],
+        );
+    }
+}
diff --git a/api/app/Models/EmailChangeRequest.php b/api/app/Models/EmailChangeRequest.php
new file mode 100644
index 00000000..77ef5aae
--- /dev/null
+++ b/api/app/Models/EmailChangeRequest.php
@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models;
+
+use App\Enums\EmailChangeStatus;
+use Illuminate\Database\Eloquent\Concerns\HasUlids;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+final class EmailChangeRequest extends Model
+{
+    use HasUlids;
+
+    protected $fillable = [
+        'user_id',
+        'current_email',
+        'new_email',
+        'token',
+        'requested_by_user_id',
+        'status',
+        'expires_at',
+        'verified_at',
+    ];
+
+    protected $hidden = ['token'];
+
+    protected function casts(): array
+    {
+        return [
+            'status' => EmailChangeStatus::class,
+            'expires_at' => 'datetime',
+            'verified_at' => 'datetime',
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function requestedBy(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'requested_by_user_id');
+    }
+
+    public function isExpired(): bool
+    {
+        return $this->expires_at->isPast();
+    }
+
+    public function scopePending($query)
+    {
+        return $query->where('status', EmailChangeStatus::PENDING)
+            ->where('expires_at', '>', now());
+    }
+}
diff --git a/api/app/Notifications/ResetPasswordNotification.php b/api/app/Notifications/ResetPasswordNotification.php
new file mode 100644
index 00000000..76196b76
--- /dev/null
+++ b/api/app/Notifications/ResetPasswordNotification.php
@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Notifications;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+final class ResetPasswordNotification extends Notification implements ShouldQueue
+{
+    use Queueable;
+
+    public function __construct(
+        private readonly string $token,
+        private readonly string $frontendUrl,
+    ) {}
+
+    public function via(mixed $notifiable): array
+    {
+        return ['mail'];
+    }
+
+    public function toMail(mixed $notifiable): MailMessage
+    {
+        $resetUrl = $this->frontendUrl . '/reset-password?token=' . $this->token
+            . '&email=' . urlencode($notifiable->email);
+
+        return (new MailMessage)
+            ->subject('Wachtwoord herstellen — Crewli')
+            ->greeting('Hallo ' . $notifiable->first_name . ',')
+            ->line('Je ontvangt deze e-mail omdat we een verzoek hebben ontvangen om je wachtwoord te herstellen.')
+            ->action('Wachtwoord herstellen', $resetUrl)
+            ->line('Deze link is 60 minuten geldig.')
+            ->line('Als je geen wachtwoordherstel hebt aangevraagd, kun je deze e-mail negeren.')
+            ->salutation('Groeten, Crewli');
+    }
+}
diff --git a/api/app/Services/EmailChangeService.php b/api/app/Services/EmailChangeService.php
new file mode 100644
index 00000000..f4ae3479
--- /dev/null
+++ b/api/app/Services/EmailChangeService.php
@@ -0,0 +1,157 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Services;
+
+use App\Enums\EmailChangeStatus;
+use App\Mail\EmailChangedConfirmationMail;
+use App\Mail\VerifyEmailChangeMail;
+use App\Models\EmailChangeRequest;
+use App\Models\Person;
+use App\Models\User;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+final class EmailChangeService
+{
+    /**
+     * Request an email change. Sends verification to the NEW email.
+     */
+    public function requestChange(
+        User $user,
+        string $newEmail,
+        User $requestedBy,
+        string $frontendUrl,
+    ): EmailChangeRequest {
+        // Validate new email is not already in use
+        if (User::where('email', $newEmail)->where('id', '!=', $user->id)->exists()) {
+            throw ValidationException::withMessages([
+                'new_email' => ['Dit e-mailadres is al in gebruik door een ander account.'],
+            ]);
+        }
+
+        // Cancel any existing pending requests for this user
+        EmailChangeRequest::where('user_id', $user->id)
+            ->where('status', EmailChangeStatus::PENDING)
+            ->update(['status' => EmailChangeStatus::CANCELLED->value]);
+
+        // Generate secure token
+        $plainToken = Str::random(64);
+
+        $request = EmailChangeRequest::create([
+            'user_id' => $user->id,
+            'current_email' => $user->email,
+            'new_email' => $newEmail,
+            'token' => hash('sha256', $plainToken),
+            'requested_by_user_id' => $requestedBy->id,
+            'status' => EmailChangeStatus::PENDING,
+            'expires_at' => now()->addHours(24),
+        ]);
+
+        // Send verification email to the NEW address
+        Mail::to($newEmail)->send(new VerifyEmailChangeMail(
+            user: $user,
+            newEmail: $newEmail,
+            token: $plainToken,
+            frontendUrl: $frontendUrl,
+            requestedBy: $requestedBy,
+        ));
+
+        activity()
+            ->causedBy($requestedBy)
+            ->performedOn($user)
+            ->withProperties([
+                'current_email' => $user->email,
+                'new_email' => $newEmail,
+                'is_self_change' => $user->id === $requestedBy->id,
+            ])
+            ->log('user.email_change_requested');
+
+        return $request;
+    }
+
+    /**
+     * Verify and execute the email change.
+     */
+    public function verifyChange(string $plainToken): EmailChangeRequest
+    {
+        $hashedToken = hash('sha256', $plainToken);
+
+        $request = EmailChangeRequest::where('token', $hashedToken)
+            ->where('status', EmailChangeStatus::PENDING)
+            ->first();
+
+        if (! $request) {
+            throw ValidationException::withMessages([
+                'token' => ['Ongeldige of verlopen verificatielink.'],
+            ]);
+        }
+
+        if ($request->isExpired()) {
+            $request->update(['status' => EmailChangeStatus::EXPIRED]);
+            throw ValidationException::withMessages([
+                'token' => ['Deze verificatielink is verlopen. Vraag opnieuw een e-mailwijziging aan.'],
+            ]);
+        }
+
+        // Final check: new email still not in use
+        if (User::where('email', $request->new_email)
+            ->where('id', '!=', $request->user_id)->exists()) {
+            $request->update(['status' => EmailChangeStatus::CANCELLED]);
+            throw ValidationException::withMessages([
+                'new_email' => ['Dit e-mailadres is inmiddels in gebruik door een ander account.'],
+            ]);
+        }
+
+        $user = $request->user;
+        $oldEmail = $user->email;
+
+        DB::transaction(function () use ($request, $user) {
+            // Update user email
+            $user->update(['email' => $request->new_email]);
+
+            // Mark request as verified
+            $request->update([
+                'status' => EmailChangeStatus::VERIFIED,
+                'verified_at' => now(),
+            ]);
+        });
+
+        // Send confirmation to the OLD email address
+        Mail::to($oldEmail)->send(new EmailChangedConfirmationMail(
+            user: $user,
+            oldEmail: $oldEmail,
+            newEmail: $request->new_email,
+        ));
+
+        // Revoke all tokens (force re-login with new email)
+        $user->tokens()->delete();
+
+        // Log linked person email context
+        $persons = Person::where('user_id', $user->id)->get();
+        foreach ($persons as $person) {
+            activity()
+                ->causedBy($user)
+                ->performedOn($person)
+                ->withProperties([
+                    'old_user_email' => $oldEmail,
+                    'new_user_email' => $request->new_email,
+                    'person_email_unchanged' => $person->email,
+                ])
+                ->log('person.linked_user_email_changed');
+        }
+
+        activity()
+            ->performedOn($user)
+            ->withProperties([
+                'old_email' => $oldEmail,
+                'new_email' => $request->new_email,
+            ])
+            ->log('user.email_changed');
+
+        return $request;
+    }
+}
diff --git a/api/config/app.php b/api/config/app.php
index 4e44f4bb..d37ad7ba 100644
--- a/api/config/app.php
+++ b/api/config/app.php
@@ -123,6 +123,7 @@ return [
         'store' => env('APP_MAINTENANCE_STORE', 'database'),
     ],
 
+    'frontend_admin_url' => env('FRONTEND_ADMIN_URL', 'http://localhost:5173'),
     'frontend_app_url' => env('FRONTEND_APP_URL', 'http://localhost:5174'),
     'frontend_portal_url' => env('FRONTEND_PORTAL_URL', 'http://localhost:5175'),
 
diff --git a/api/database/migrations/2026_04_14_300000_create_email_change_requests_table.php b/api/database/migrations/2026_04_14_300000_create_email_change_requests_table.php
new file mode 100644
index 00000000..f394fc34
--- /dev/null
+++ b/api/database/migrations/2026_04_14_300000_create_email_change_requests_table.php
@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('email_change_requests', function (Blueprint $table) {
+            $table->ulid('id')->primary();
+            $table->ulid('user_id');
+            $table->string('current_email');
+            $table->string('new_email');
+            $table->string('token');
+            $table->ulid('requested_by_user_id')->nullable();
+            $table->string('status')->default('pending');
+            $table->timestamp('expires_at');
+            $table->timestamp('verified_at')->nullable();
+            $table->timestamps();
+
+            $table->foreign('user_id')->references('id')->on('users')->cascadeOnDelete();
+            $table->foreign('requested_by_user_id')->references('id')->on('users')->nullOnDelete();
+            $table->index(['user_id', 'status']);
+            $table->index(['token']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('email_change_requests');
+    }
+};
diff --git a/api/resources/views/emails/email-changed-confirmation.blade.php b/api/resources/views/emails/email-changed-confirmation.blade.php
new file mode 100644
index 00000000..159ff70c
--- /dev/null
+++ b/api/resources/views/emails/email-changed-confirmation.blade.php
@@ -0,0 +1,12 @@
+@component('mail::message')
+# Je e-mailadres is gewijzigd
+
+Hallo {{ $userName }},
+
+Het e-mailadres van je Crewli-account is zojuist gewijzigd naar **{{ $newEmail }}**.
+
+Als je deze wijziging niet hebt aangevraagd, neem dan onmiddellijk contact met ons op.
+
+Groeten,<br>
+Crewli
+@endcomponent
diff --git a/api/resources/views/emails/verify-email-change.blade.php b/api/resources/views/emails/verify-email-change.blade.php
new file mode 100644
index 00000000..17479e2f
--- /dev/null
+++ b/api/resources/views/emails/verify-email-change.blade.php
@@ -0,0 +1,22 @@
+@component('mail::message')
+# Bevestig je nieuwe e-mailadres
+
+Hallo {{ $userName }},
+
+@if($isSelfChange)
+Je hebt verzocht om je e-mailadres te wijzigen naar dit adres.
+@else
+{{ $requestedByName }} heeft verzocht om je e-mailadres te wijzigen naar dit adres.
+@endif
+
+Klik op de knop hieronder om te bevestigen dat dit e-mailadres van jou is.
+
+@component('mail::button', ['url' => $verifyUrl])
+E-mailadres bevestigen
+@endcomponent
+
+Deze link is 24 uur geldig. Als je dit niet hebt aangevraagd, kun je deze e-mail negeren.
+
+Groeten,<br>
+Crewli
+@endcomponent
diff --git a/api/routes/api.php b/api/routes/api.php
index 15e45a9c..71572858 100644
--- a/api/routes/api.php
+++ b/api/routes/api.php
@@ -29,6 +29,8 @@ use App\Http\Controllers\Api\V1\VolunteerAvailabilityController;
 use App\Http\Controllers\Api\V1\VolunteerRegistrationController;
 use App\Http\Controllers\Api\V1\PublicRegistrationDataController;
 use App\Http\Controllers\Api\V1\PortalTokenController;
+use App\Http\Controllers\Api\V1\AccountController;
+use App\Http\Controllers\Api\V1\EmailChangeController;
 use App\Http\Controllers\Api\V1\PasswordResetController;
 use App\Http\Controllers\Api\V1\PortalMeController;
 use App\Http\Controllers\Api\V1\Portal\PortalShiftController;
@@ -66,6 +68,9 @@ Route::post('auth/forgot-password', [PasswordResetController::class, 'sendResetL
     ->middleware('throttle:5,1');
 Route::post('auth/reset-password', [PasswordResetController::class, 'resetPassword']);
 
+// Email change verification (public — token from email link)
+Route::post('verify-email-change', [EmailChangeController::class, 'verify']);
+
 // Public portal routes
 Route::get('public/events/{slug}/registration-data', PublicRegistrationDataController::class);
 Route::post('public/check-email', CheckEmailController::class)->middleware('throttle:10,1');
@@ -78,6 +83,10 @@ Route::middleware('auth:sanctum')->group(function () {
     Route::get('auth/me', MeController::class);
     Route::post('auth/logout', LogoutController::class);
 
+    // Account management (self-service)
+    Route::post('me/change-password', [AccountController::class, 'changePassword']);
+    Route::post('me/change-email', [EmailChangeController::class, 'request']);
+
     // Portal (authenticated)
     Route::get('portal/me', [PortalMeController::class, 'index']);
     Route::put('portal/profile', [PortalMeController::class, 'updateProfile']);
@@ -148,6 +157,7 @@ Route::middleware('auth:sanctum')->group(function () {
         Route::get('members', [MemberController::class, 'index']);
         Route::put('members/{user}', [MemberController::class, 'update']);
         Route::delete('members/{user}', [MemberController::class, 'destroy']);
+        Route::post('members/{user}/change-email', [MemberController::class, 'changeEmail']);
 
         // Event sub-resources (all nested under organisation prefix — A01-13)
         Route::prefix('events/{event}')->group(function () {
diff --git a/api/tests/Feature/Api/V1/EmailChangeTest.php b/api/tests/Feature/Api/V1/EmailChangeTest.php
new file mode 100644
index 00000000..01dd1ab2
--- /dev/null
+++ b/api/tests/Feature/Api/V1/EmailChangeTest.php
@@ -0,0 +1,303 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\V1;
+
+use App\Enums\EmailChangeStatus;
+use App\Mail\EmailChangedConfirmationMail;
+use App\Mail\VerifyEmailChangeMail;
+use App\Models\EmailChangeRequest;
+use App\Models\Organisation;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Mail;
+use Tests\TestCase;
+
+class EmailChangeTest extends TestCase
+{
+    use RefreshDatabase;
+
+    // ─── Self-Service Email Change ──────────────────────────────────────
+
+    public function test_user_can_request_email_change(): void
+    {
+        Mail::fake();
+
+        $user = User::factory()->create([
+            'email' => 'oud@voorbeeld.nl',
+            'password' => bcrypt('wachtwoord123'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-email', [
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'password' => 'wachtwoord123',
+            'app' => 'app',
+        ]);
+
+        $response->assertOk();
+
+        $this->assertDatabaseHas('email_change_requests', [
+            'user_id' => $user->id,
+            'current_email' => 'oud@voorbeeld.nl',
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'status' => 'pending',
+        ]);
+
+        Mail::assertQueued(VerifyEmailChangeMail::class, function ($mail) {
+            return $mail->hasTo('nieuw@voorbeeld.nl');
+        });
+    }
+
+    public function test_email_change_requires_correct_password(): void
+    {
+        $user = User::factory()->create([
+            'password' => bcrypt('wachtwoord123'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-email', [
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'password' => 'foutwachtwoord',
+            'app' => 'app',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('password');
+    }
+
+    public function test_email_change_rejects_already_used_email(): void
+    {
+        User::factory()->create(['email' => 'bezet@voorbeeld.nl']);
+
+        $user = User::factory()->create([
+            'password' => bcrypt('wachtwoord123'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-email', [
+            'new_email' => 'bezet@voorbeeld.nl',
+            'password' => 'wachtwoord123',
+            'app' => 'app',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('new_email');
+    }
+
+    public function test_email_change_requires_authentication(): void
+    {
+        $response = $this->postJson('/api/v1/me/change-email', [
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'password' => 'wachtwoord123',
+            'app' => 'app',
+        ]);
+
+        $response->assertStatus(401);
+    }
+
+    public function test_duplicate_pending_request_cancels_old_one(): void
+    {
+        Mail::fake();
+
+        $user = User::factory()->create([
+            'email' => 'oud@voorbeeld.nl',
+            'password' => bcrypt('wachtwoord123'),
+        ]);
+
+        // First request
+        $this->actingAs($user)->postJson('/api/v1/me/change-email', [
+            'new_email' => 'eerste@voorbeeld.nl',
+            'password' => 'wachtwoord123',
+            'app' => 'app',
+        ]);
+
+        $firstRequest = EmailChangeRequest::where('new_email', 'eerste@voorbeeld.nl')->first();
+        $this->assertEquals('pending', $firstRequest->status->value);
+
+        // Second request
+        $this->actingAs($user)->postJson('/api/v1/me/change-email', [
+            'new_email' => 'tweede@voorbeeld.nl',
+            'password' => 'wachtwoord123',
+            'app' => 'app',
+        ]);
+
+        $firstRequest->refresh();
+        $this->assertEquals('cancelled', $firstRequest->status->value);
+
+        $secondRequest = EmailChangeRequest::where('new_email', 'tweede@voorbeeld.nl')->first();
+        $this->assertEquals('pending', $secondRequest->status->value);
+    }
+
+    // ─── Email Change Verification ──────────────────────────────────────
+
+    public function test_verify_email_change_with_valid_token(): void
+    {
+        Mail::fake();
+
+        $user = User::factory()->create(['email' => 'oud@voorbeeld.nl']);
+        $plainToken = 'test-token-12345678901234567890123456789012345678901234567890123456';
+
+        EmailChangeRequest::create([
+            'user_id' => $user->id,
+            'current_email' => 'oud@voorbeeld.nl',
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'token' => hash('sha256', $plainToken),
+            'requested_by_user_id' => $user->id,
+            'status' => EmailChangeStatus::PENDING,
+            'expires_at' => now()->addHours(24),
+        ]);
+
+        $response = $this->postJson('/api/v1/verify-email-change', [
+            'token' => $plainToken,
+        ]);
+
+        $response->assertOk();
+
+        $user->refresh();
+        $this->assertEquals('nieuw@voorbeeld.nl', $user->email);
+
+        Mail::assertQueued(EmailChangedConfirmationMail::class, function ($mail) {
+            return $mail->hasTo('oud@voorbeeld.nl');
+        });
+    }
+
+    public function test_verify_email_change_revokes_all_tokens(): void
+    {
+        Mail::fake();
+
+        $user = User::factory()->create(['email' => 'oud@voorbeeld.nl']);
+        $user->createToken('test-token');
+
+        $plainToken = 'test-token-12345678901234567890123456789012345678901234567890123456';
+
+        EmailChangeRequest::create([
+            'user_id' => $user->id,
+            'current_email' => 'oud@voorbeeld.nl',
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'token' => hash('sha256', $plainToken),
+            'requested_by_user_id' => $user->id,
+            'status' => EmailChangeStatus::PENDING,
+            'expires_at' => now()->addHours(24),
+        ]);
+
+        $this->postJson('/api/v1/verify-email-change', [
+            'token' => $plainToken,
+        ]);
+
+        $this->assertCount(0, $user->tokens()->get());
+    }
+
+    public function test_verify_email_change_with_expired_token(): void
+    {
+        $user = User::factory()->create(['email' => 'oud@voorbeeld.nl']);
+        $plainToken = 'test-token-12345678901234567890123456789012345678901234567890123456';
+
+        EmailChangeRequest::create([
+            'user_id' => $user->id,
+            'current_email' => 'oud@voorbeeld.nl',
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'token' => hash('sha256', $plainToken),
+            'requested_by_user_id' => $user->id,
+            'status' => EmailChangeStatus::PENDING,
+            'expires_at' => now()->subHour(),
+        ]);
+
+        $response = $this->postJson('/api/v1/verify-email-change', [
+            'token' => $plainToken,
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('token');
+    }
+
+    public function test_verify_email_change_with_invalid_token(): void
+    {
+        $response = $this->postJson('/api/v1/verify-email-change', [
+            'token' => 'completely-invalid-token',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('token');
+    }
+
+    public function test_verify_email_change_fails_if_email_taken_between_request_and_verify(): void
+    {
+        $user = User::factory()->create(['email' => 'oud@voorbeeld.nl']);
+        $plainToken = 'test-token-12345678901234567890123456789012345678901234567890123456';
+
+        EmailChangeRequest::create([
+            'user_id' => $user->id,
+            'current_email' => 'oud@voorbeeld.nl',
+            'new_email' => 'nieuw@voorbeeld.nl',
+            'token' => hash('sha256', $plainToken),
+            'requested_by_user_id' => $user->id,
+            'status' => EmailChangeStatus::PENDING,
+            'expires_at' => now()->addHours(24),
+        ]);
+
+        // Another user takes the email
+        User::factory()->create(['email' => 'nieuw@voorbeeld.nl']);
+
+        $response = $this->postJson('/api/v1/verify-email-change', [
+            'token' => $plainToken,
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('new_email');
+    }
+
+    // ─── Admin Email Change ─────────────────────────────────────────────
+
+    public function test_admin_can_change_member_email(): void
+    {
+        Mail::fake();
+
+        $organisation = Organisation::factory()->create();
+        $admin = User::factory()->create();
+        $organisation->users()->attach($admin, ['role' => 'org_admin']);
+
+        $member = User::factory()->create(['email' => 'lid@voorbeeld.nl']);
+        $organisation->users()->attach($member, ['role' => 'org_member']);
+
+        $response = $this->actingAs($admin)->postJson(
+            "/api/v1/organisations/{$organisation->id}/members/{$member->id}/change-email",
+            ['new_email' => 'nieuw-lid@voorbeeld.nl'],
+        );
+
+        $response->assertOk();
+
+        Mail::assertQueued(VerifyEmailChangeMail::class, function ($mail) {
+            return $mail->hasTo('nieuw-lid@voorbeeld.nl');
+        });
+    }
+
+    public function test_non_admin_cannot_change_member_email(): void
+    {
+        $organisation = Organisation::factory()->create();
+        $member = User::factory()->create();
+        $organisation->users()->attach($member, ['role' => 'org_member']);
+
+        $otherMember = User::factory()->create(['email' => 'ander@voorbeeld.nl']);
+        $organisation->users()->attach($otherMember, ['role' => 'org_member']);
+
+        $response = $this->actingAs($member)->postJson(
+            "/api/v1/organisations/{$organisation->id}/members/{$otherMember->id}/change-email",
+            ['new_email' => 'nieuw@voorbeeld.nl'],
+        );
+
+        $response->assertStatus(403);
+    }
+
+    public function test_unauthenticated_cannot_change_member_email(): void
+    {
+        $organisation = Organisation::factory()->create();
+        $member = User::factory()->create();
+        $organisation->users()->attach($member, ['role' => 'org_member']);
+
+        $response = $this->postJson(
+            "/api/v1/organisations/{$organisation->id}/members/{$member->id}/change-email",
+            ['new_email' => 'nieuw@voorbeeld.nl'],
+        );
+
+        $response->assertStatus(401);
+    }
+}
diff --git a/api/tests/Feature/Api/V1/PasswordChangeTest.php b/api/tests/Feature/Api/V1/PasswordChangeTest.php
new file mode 100644
index 00000000..8989bda5
--- /dev/null
+++ b/api/tests/Feature/Api/V1/PasswordChangeTest.php
@@ -0,0 +1,118 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Feature\Api\V1;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class PasswordChangeTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_user_can_change_password(): void
+    {
+        $user = User::factory()->create([
+            'password' => bcrypt('OudWachtwoord1'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-password', [
+            'current_password' => 'OudWachtwoord1',
+            'password' => 'NieuwWachtwoord1',
+            'password_confirmation' => 'NieuwWachtwoord1',
+        ]);
+
+        $response->assertOk();
+
+        $user->refresh();
+        $this->assertTrue(Hash::check('NieuwWachtwoord1', $user->password));
+    }
+
+    public function test_password_change_requires_correct_current_password(): void
+    {
+        $user = User::factory()->create([
+            'password' => bcrypt('OudWachtwoord1'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-password', [
+            'current_password' => 'FoutWachtwoord1',
+            'password' => 'NieuwWachtwoord1',
+            'password_confirmation' => 'NieuwWachtwoord1',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('current_password');
+    }
+
+    public function test_password_change_revokes_other_tokens(): void
+    {
+        $user = User::factory()->create([
+            'password' => bcrypt('OudWachtwoord1'),
+        ]);
+
+        // Create two tokens
+        $currentToken = $user->createToken('current-session');
+        $otherToken = $user->createToken('other-session');
+
+        $this->assertCount(2, $user->tokens()->get());
+
+        // Act as user with the current token
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer ' . $currentToken->plainTextToken,
+        ])->postJson('/api/v1/me/change-password', [
+            'current_password' => 'OudWachtwoord1',
+            'password' => 'NieuwWachtwoord1',
+            'password_confirmation' => 'NieuwWachtwoord1',
+        ]);
+
+        $response->assertOk();
+
+        // Only the current session token should remain
+        $this->assertCount(1, $user->tokens()->get());
+    }
+
+    public function test_password_change_requires_confirmation(): void
+    {
+        $user = User::factory()->create([
+            'password' => bcrypt('OudWachtwoord1'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-password', [
+            'current_password' => 'OudWachtwoord1',
+            'password' => 'NieuwWachtwoord1',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('password');
+    }
+
+    public function test_password_change_requires_authentication(): void
+    {
+        $response = $this->postJson('/api/v1/me/change-password', [
+            'current_password' => 'OudWachtwoord1',
+            'password' => 'NieuwWachtwoord1',
+            'password_confirmation' => 'NieuwWachtwoord1',
+        ]);
+
+        $response->assertStatus(401);
+    }
+
+    public function test_password_change_enforces_password_rules(): void
+    {
+        $user = User::factory()->create([
+            'password' => bcrypt('OudWachtwoord1'),
+        ]);
+
+        $response = $this->actingAs($user)->postJson('/api/v1/me/change-password', [
+            'current_password' => 'OudWachtwoord1',
+            'password' => 'short',
+            'password_confirmation' => 'short',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('password');
+    }
+}
diff --git a/api/tests/Feature/Api/V1/PasswordResetTest.php b/api/tests/Feature/Api/V1/PasswordResetTest.php
index ebbd1ac4..5fbbc420 100644
--- a/api/tests/Feature/Api/V1/PasswordResetTest.php
+++ b/api/tests/Feature/Api/V1/PasswordResetTest.php
@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace Tests\Feature\Api\V1;
 
 use App\Models\User;
+use App\Notifications\ResetPasswordNotification;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Notification;
@@ -21,38 +22,53 @@ class PasswordResetTest extends TestCase
     {
         Notification::fake();
 
-        User::factory()->create(['email' => 'jan@voorbeeld.nl']);
+        $user = User::factory()->create(['email' => 'jan@voorbeeld.nl']);
 
         $response = $this->postJson('/api/v1/auth/forgot-password', [
             'email' => 'jan@voorbeeld.nl',
+            'app' => 'app',
         ]);
 
         $response->assertOk();
-        $response->assertJsonPath('message', 'Als dit emailadres bij ons bekend is, ontvang je een link om je wachtwoord te resetten.');
+
+        Notification::assertSentTo($user, ResetPasswordNotification::class);
     }
 
     public function test_forgot_password_returns_same_success_for_nonexisting_email(): void
     {
         $response = $this->postJson('/api/v1/auth/forgot-password', [
             'email' => 'onbekend@voorbeeld.nl',
+            'app' => 'app',
         ]);
 
         $response->assertOk();
-        $response->assertJsonPath('message', 'Als dit emailadres bij ons bekend is, ontvang je een link om je wachtwoord te resetten.');
+    }
+
+    public function test_forgot_password_requires_app_parameter(): void
+    {
+        $response = $this->postJson('/api/v1/auth/forgot-password', [
+            'email' => 'jan@voorbeeld.nl',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('app');
+    }
+
+    public function test_forgot_password_validates_app_values(): void
+    {
+        $response = $this->postJson('/api/v1/auth/forgot-password', [
+            'email' => 'jan@voorbeeld.nl',
+            'app' => 'invalid',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors('app');
     }
 
     public function test_forgot_password_validates_email_required(): void
-    {
-        $response = $this->postJson('/api/v1/auth/forgot-password', []);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors('email');
-    }
-
-    public function test_forgot_password_validates_email_format(): void
     {
         $response = $this->postJson('/api/v1/auth/forgot-password', [
-            'email' => 'not-an-email',
+            'app' => 'app',
         ]);
 
         $response->assertStatus(422);
@@ -64,11 +80,13 @@ class PasswordResetTest extends TestCase
         for ($i = 0; $i < 5; $i++) {
             $this->postJson('/api/v1/auth/forgot-password', [
                 'email' => 'test@voorbeeld.nl',
+                'app' => 'portal',
             ]);
         }
 
         $response = $this->postJson('/api/v1/auth/forgot-password', [
             'email' => 'test@voorbeeld.nl',
+            'app' => 'portal',
         ]);
 
         $response->assertStatus(429);
@@ -90,13 +108,30 @@ class PasswordResetTest extends TestCase
         ]);
 
         $response->assertOk();
-        $response->assertJsonPath('message', 'Wachtwoord succesvol gewijzigd.');
 
-        // Verify password was actually changed
         $user->refresh();
         $this->assertTrue(Hash::check('NieuwWachtwoord1', $user->password));
     }
 
+    public function test_reset_password_revokes_all_tokens(): void
+    {
+        $user = User::factory()->create(['email' => 'jan@voorbeeld.nl']);
+        $user->createToken('test-token');
+
+        $this->assertCount(1, $user->tokens);
+
+        $token = Password::createToken($user);
+
+        $this->postJson('/api/v1/auth/reset-password', [
+            'token' => $token,
+            'email' => 'jan@voorbeeld.nl',
+            'password' => 'NieuwWachtwoord1',
+            'password_confirmation' => 'NieuwWachtwoord1',
+        ]);
+
+        $this->assertCount(0, $user->tokens()->get());
+    }
+
     public function test_reset_password_with_invalid_token_returns_422(): void
     {
         User::factory()->create(['email' => 'jan@voorbeeld.nl']);
@@ -127,23 +162,6 @@ class PasswordResetTest extends TestCase
         $response->assertJsonValidationErrors('password');
     }
 
-    public function test_reset_password_requires_minimum_length(): void
-    {
-        $user = User::factory()->create(['email' => 'jan@voorbeeld.nl']);
-
-        $token = Password::createToken($user);
-
-        $response = $this->postJson('/api/v1/auth/reset-password', [
-            'token' => $token,
-            'email' => 'jan@voorbeeld.nl',
-            'password' => 'short',
-            'password_confirmation' => 'short',
-        ]);
-
-        $response->assertStatus(422);
-        $response->assertJsonValidationErrors('password');
-    }
-
     public function test_reset_password_validates_required_fields(): void
     {
         $response = $this->postJson('/api/v1/auth/reset-password', []);
diff --git a/api/tests/Feature/Security/AuthenticationSecurityTest.php b/api/tests/Feature/Security/AuthenticationSecurityTest.php
index 1340a698..ec693e3d 100644
--- a/api/tests/Feature/Security/AuthenticationSecurityTest.php
+++ b/api/tests/Feature/Security/AuthenticationSecurityTest.php
@@ -100,6 +100,7 @@ final class AuthenticationSecurityTest extends TestCase
     {
         $response = $this->postJson('/api/v1/auth/forgot-password', [
             'email' => 'nonexistent@example.com',
+            'app' => 'app',
         ]);
 
         // Must return 200 regardless — don't leak whether email exists
@@ -112,6 +113,7 @@ final class AuthenticationSecurityTest extends TestCase
 
         $response = $this->postJson('/api/v1/auth/forgot-password', [
             'email' => $user->email,
+            'app' => 'app',
         ]);
 
         $response->assertOk();
diff --git a/apps/admin/src/lib/axios.ts b/apps/admin/src/lib/axios.ts
index c29eeb79..d0560ed0 100644
--- a/apps/admin/src/lib/axios.ts
+++ b/apps/admin/src/lib/axios.ts
@@ -55,7 +55,8 @@ apiClient.interceptors.response.use(
       document.cookie = 'accessToken=; path=/; max-age=0'
       document.cookie = 'userData=; path=/; max-age=0'
       document.cookie = 'userAbilityRules=; path=/; max-age=0'
-      if (window.location.pathname !== '/login') {
+      const publicPaths = ['/login', '/forgot-password', '/reset-password', '/verify-email-change']
+      if (!publicPaths.some(p => window.location.pathname.startsWith(p))) {
         window.location.href = '/login'
       }
     }
diff --git a/apps/admin/src/pages/forgot-password.vue b/apps/admin/src/pages/forgot-password.vue
index 93550534..910d3ffa 100644
--- a/apps/admin/src/pages/forgot-password.vue
+++ b/apps/admin/src/pages/forgot-password.vue
@@ -8,10 +8,13 @@ import authV2ForgotPasswordIllustrationLight from '@images/pages/auth-v2-forgot-
 import authV2MaskDark from '@images/pages/misc-mask-dark.png'
 import authV2MaskLight from '@images/pages/misc-mask-light.png'
 
+import { apiClient } from '@/lib/axios'
+
 const email = ref('')
+const isSubmitting = ref(false)
+const done = ref(false)
 
 const authThemeImg = useGenerateImageVariant(authV2ForgotPasswordIllustrationLight, authV2ForgotPasswordIllustrationDark)
-
 const authThemeMask = useGenerateImageVariant(authV2MaskLight, authV2MaskDark)
 
 definePage({
@@ -20,6 +23,23 @@ definePage({
     unauthenticatedOnly: true,
   },
 })
+
+async function onSubmit(): Promise<void> {
+  isSubmitting.value = true
+  try {
+    await apiClient.post('/auth/forgot-password', {
+      email: email.value.trim(),
+      app: 'admin',
+    })
+  }
+  catch {
+    // Always show generic success (no email enumeration)
+  }
+  finally {
+    isSubmitting.value = false
+    done.value = true
+  }
+}
 </script>
 
 <template>
@@ -74,38 +94,48 @@ definePage({
       >
         <VCardText>
           <h4 class="text-h4 mb-1">
-            Forgot Password? 🔒
+            Wachtwoord vergeten?
           </h4>
           <p class="mb-0">
-            Enter your email and we'll send you instructions to reset your password
+            Vul je e-mailadres in en we sturen je een link om je wachtwoord te herstellen.
           </p>
         </VCardText>
 
         <VCardText>
-          <VForm @submit.prevent="() => {}">
+          <VAlert
+            v-if="done"
+            type="success"
+            variant="tonal"
+            class="mb-4"
+          >
+            Als dit e-mailadres bij ons bekend is, ontvang je een link om je wachtwoord te herstellen.
+          </VAlert>
+
+          <VForm
+            v-if="!done"
+            @submit.prevent="onSubmit"
+          >
             <VRow>
-              <!-- email -->
               <VCol cols="12">
                 <AppTextField
                   v-model="email"
                   autofocus
-                  label="Email"
+                  label="E-mailadres"
                   type="email"
-                  placeholder="johndoe@email.com"
+                  placeholder="naam@voorbeeld.nl"
                 />
               </VCol>
 
-              <!-- Reset link -->
               <VCol cols="12">
                 <VBtn
                   block
                   type="submit"
+                  :loading="isSubmitting"
                 >
-                  Send Reset Link
+                  Verstuur herstelmail
                 </VBtn>
               </VCol>
 
-              <!-- back to login -->
               <VCol cols="12">
                 <RouterLink
                   class="d-flex align-center justify-center"
@@ -116,7 +146,7 @@ definePage({
                     size="20"
                     class="me-1 flip-in-rtl"
                   />
-                  <span>Back to login</span>
+                  <span>Terug naar inloggen</span>
                 </RouterLink>
               </VCol>
             </VRow>
diff --git a/apps/admin/src/pages/login.vue b/apps/admin/src/pages/login.vue
index 2582946d..7a6682b6 100644
--- a/apps/admin/src/pages/login.vue
+++ b/apps/admin/src/pages/login.vue
@@ -40,6 +40,8 @@ const isPasswordVisible = ref(false)
 const route = useRoute()
 const router = useRouter()
 
+const passwordResetDone = computed(() => route.query.reset === '1')
+
 const ability = useAbility()
 
 const errors = ref<Record<string, string | undefined>>({
@@ -170,6 +172,16 @@ const onSubmit = () => {
           </p>
         </VCardText>
         <VCardText>
+          <VAlert
+            v-if="passwordResetDone"
+            type="success"
+            variant="tonal"
+            class="mb-4"
+            density="comfortable"
+          >
+            Wachtwoord gewijzigd. Je kunt nu inloggen.
+          </VAlert>
+
           <VForm
             ref="refVForm"
             @submit.prevent="onSubmit"
diff --git a/apps/admin/src/pages/reset-password.vue b/apps/admin/src/pages/reset-password.vue
new file mode 100644
index 00000000..9ec34dc9
--- /dev/null
+++ b/apps/admin/src/pages/reset-password.vue
@@ -0,0 +1,204 @@
+<script setup lang="ts">
+import { useGenerateImageVariant } from '@core/composable/useGenerateImageVariant'
+import { VNodeRenderer } from '@layouts/components/VNodeRenderer'
+import { themeConfig } from '@themeConfig'
+
+import authV2ResetPasswordIllustrationDark from '@images/pages/auth-v2-reset-password-illustration-dark.png'
+import authV2ResetPasswordIllustrationLight from '@images/pages/auth-v2-reset-password-illustration-light.png'
+import authV2MaskDark from '@images/pages/misc-mask-dark.png'
+import authV2MaskLight from '@images/pages/misc-mask-light.png'
+
+import { apiClient } from '@/lib/axios'
+
+definePage({
+  meta: {
+    layout: 'blank',
+    unauthenticatedOnly: true,
+  },
+})
+
+const route = useRoute()
+const router = useRouter()
+
+const email = ref(typeof route.query.email === 'string' ? route.query.email : '')
+const token = ref(typeof route.query.token === 'string' ? route.query.token : '')
+const password = ref('')
+const passwordConfirmation = ref('')
+const showPassword = ref(false)
+const showPasswordConfirmation = ref(false)
+
+const errorMessage = ref('')
+const isSubmitting = ref(false)
+
+const authThemeImg = useGenerateImageVariant(
+  authV2ResetPasswordIllustrationLight,
+  authV2ResetPasswordIllustrationDark,
+)
+const authThemeMask = useGenerateImageVariant(authV2MaskLight, authV2MaskDark)
+
+async function onSubmit(): Promise<void> {
+  errorMessage.value = ''
+  if (!token.value || !email.value) {
+    errorMessage.value = 'Ongeldige resetlink. Vraag een nieuwe link aan.'
+    return
+  }
+  isSubmitting.value = true
+  try {
+    await apiClient.post('/auth/reset-password', {
+      email: email.value.trim(),
+      password: password.value,
+      password_confirmation: passwordConfirmation.value,
+      token: token.value,
+    })
+    await router.replace({ path: '/login', query: { reset: '1' } })
+  }
+  catch (error: unknown) {
+    const ax = error as { response?: { status?: number; data?: { message?: string } } }
+    if (ax.response?.status === 404 || ax.response?.status === 422)
+      errorMessage.value = ax.response?.data?.message ?? 'Resetlink ongeldig of verlopen. Vraag een nieuwe link aan.'
+    else
+      errorMessage.value = 'Er ging iets mis. Probeer het later opnieuw.'
+  }
+  finally {
+    isSubmitting.value = false
+  }
+}
+</script>
+
+<template>
+  <RouterLink to="/">
+    <div class="auth-logo d-flex align-center gap-x-3">
+      <VNodeRenderer :nodes="themeConfig.app.logo" />
+      <h1 class="auth-title">
+        {{ themeConfig.app.title }}
+      </h1>
+    </div>
+  </RouterLink>
+
+  <VRow
+    class="auth-wrapper bg-surface"
+    no-gutters
+  >
+    <VCol
+      md="8"
+      class="d-none d-md-flex"
+    >
+      <div class="position-relative bg-background w-100 me-0">
+        <div
+          class="d-flex align-center justify-center w-100 h-100"
+          style="padding-inline: 150px;"
+        >
+          <VImg
+            max-width="468"
+            :src="authThemeImg"
+            class="auth-illustration mt-16 mb-2"
+          />
+        </div>
+
+        <img
+          class="auth-footer-mask"
+          :src="authThemeMask"
+          alt="auth-footer-mask"
+          height="280"
+          width="100"
+        >
+      </div>
+    </VCol>
+
+    <VCol
+      cols="12"
+      md="4"
+      class="auth-card-v2 d-flex align-center justify-center"
+    >
+      <VCard
+        flat
+        :max-width="500"
+        class="mt-12 mt-sm-0 pa-6"
+      >
+        <VCardText>
+          <h4 class="text-h4 mb-1">
+            Nieuw wachtwoord instellen
+          </h4>
+          <p class="mb-0">
+            Kies een nieuw wachtwoord voor je account.
+          </p>
+        </VCardText>
+
+        <VCardText>
+          <VAlert
+            v-if="errorMessage"
+            type="error"
+            variant="tonal"
+            class="mb-4"
+          >
+            {{ errorMessage }}
+          </VAlert>
+
+          <VForm @submit.prevent="onSubmit">
+            <VRow>
+              <VCol cols="12">
+                <AppTextField
+                  v-model="email"
+                  label="E-mailadres"
+                  type="email"
+                  readonly
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <AppTextField
+                  v-model="password"
+                  label="Nieuw wachtwoord"
+                  autofocus
+                  :type="showPassword ? 'text' : 'password'"
+                  :append-inner-icon="showPassword ? 'tabler-eye-off' : 'tabler-eye'"
+                  autocomplete="new-password"
+                  @click:append-inner="showPassword = !showPassword"
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <AppTextField
+                  v-model="passwordConfirmation"
+                  label="Bevestig wachtwoord"
+                  :type="showPasswordConfirmation ? 'text' : 'password'"
+                  :append-inner-icon="showPasswordConfirmation ? 'tabler-eye-off' : 'tabler-eye'"
+                  autocomplete="new-password"
+                  @click:append-inner="showPasswordConfirmation = !showPasswordConfirmation"
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <VBtn
+                  block
+                  type="submit"
+                  :loading="isSubmitting"
+                >
+                  Wachtwoord opslaan
+                </VBtn>
+              </VCol>
+
+              <VCol cols="12">
+                <RouterLink
+                  class="d-flex align-center justify-center"
+                  :to="{ name: 'login' }"
+                >
+                  <VIcon
+                    icon="tabler-chevron-left"
+                    size="20"
+                    class="me-1 flip-in-rtl"
+                  />
+                  <span>Terug naar inloggen</span>
+                </RouterLink>
+              </VCol>
+            </VRow>
+          </VForm>
+        </VCardText>
+      </VCard>
+    </VCol>
+  </VRow>
+</template>
+
+<style lang="scss">
+@use "@core/scss/template/pages/page-auth";
+</style>
diff --git a/apps/admin/src/pages/verify-email-change.vue b/apps/admin/src/pages/verify-email-change.vue
new file mode 100644
index 00000000..cca7e47e
--- /dev/null
+++ b/apps/admin/src/pages/verify-email-change.vue
@@ -0,0 +1,117 @@
+<script setup lang="ts">
+import { VNodeRenderer } from '@layouts/components/VNodeRenderer'
+import { themeConfig } from '@themeConfig'
+import { apiClient } from '@/lib/axios'
+
+definePage({
+  meta: {
+    layout: 'blank',
+    unauthenticatedOnly: true,
+  },
+})
+
+const route = useRoute()
+
+const isVerifying = ref(true)
+const success = ref(false)
+const errorMessage = ref('')
+
+onMounted(async () => {
+  const token = route.query.token as string
+  if (!token) {
+    errorMessage.value = 'Geen verificatietoken gevonden.'
+    isVerifying.value = false
+    return
+  }
+  try {
+    await apiClient.post('/verify-email-change', { token })
+    success.value = true
+    // Clear auth cookies — email changed, force re-login
+    document.cookie = 'accessToken=; path=/; max-age=0'
+    document.cookie = 'userData=; path=/; max-age=0'
+    document.cookie = 'userAbilityRules=; path=/; max-age=0'
+  }
+  catch (error: unknown) {
+    const ax = error as { response?: { data?: { errors?: Record<string, string[]>; message?: string } } }
+    errorMessage.value = ax.response?.data?.errors?.token?.[0]
+      ?? ax.response?.data?.errors?.new_email?.[0]
+      ?? ax.response?.data?.message
+      ?? 'Er is een fout opgetreden bij de verificatie.'
+  }
+  finally {
+    isVerifying.value = false
+  }
+})
+</script>
+
+<template>
+  <div class="auth-wrapper d-flex align-center justify-center pa-4 bg-surface" style="min-height: 100vh;">
+    <div class="auth-logo d-flex align-center gap-x-3 position-absolute" style="inset-block-start: 2rem; inset-inline-start: 2.5rem;">
+      <VNodeRenderer :nodes="themeConfig.app.logo" />
+      <h1 class="auth-title">
+        {{ themeConfig.app.title }}
+      </h1>
+    </div>
+
+    <VCard
+      flat
+      :max-width="450"
+      width="100%"
+      class="pa-6"
+    >
+      <VCardText class="text-center">
+        <template v-if="isVerifying">
+          <VProgressCircular
+            indeterminate
+            color="primary"
+            class="mb-4"
+          />
+          <p>E-mailadres wordt geverifieerd...</p>
+        </template>
+
+        <template v-else-if="success">
+          <VIcon
+            size="64"
+            color="success"
+            class="mb-4"
+          >
+            tabler-circle-check
+          </VIcon>
+          <h4 class="text-h5 mb-2">
+            E-mailadres gewijzigd!
+          </h4>
+          <p class="text-body-2 text-medium-emphasis mb-4">
+            Je e-mailadres is succesvol gewijzigd.
+            Log opnieuw in met je nieuwe e-mailadres.
+          </p>
+          <VBtn
+            color="primary"
+            :to="{ name: 'login' }"
+          >
+            Ga naar inloggen
+          </VBtn>
+        </template>
+
+        <template v-else>
+          <VIcon
+            size="64"
+            color="error"
+            class="mb-4"
+          >
+            tabler-circle-x
+          </VIcon>
+          <h4 class="text-h5 mb-2">
+            Verificatie mislukt
+          </h4>
+          <p class="text-body-2 text-medium-emphasis">
+            {{ errorMessage }}
+          </p>
+        </template>
+      </VCardText>
+    </VCard>
+  </div>
+</template>
+
+<style lang="scss">
+@use "@core/scss/template/pages/page-auth";
+</style>
diff --git a/apps/app/src/composables/api/useAccount.ts b/apps/app/src/composables/api/useAccount.ts
new file mode 100644
index 00000000..c8096788
--- /dev/null
+++ b/apps/app/src/composables/api/useAccount.ts
@@ -0,0 +1,61 @@
+import { useMutation } from '@tanstack/vue-query'
+import type { Ref } from 'vue'
+import { apiClient } from '@/lib/axios'
+
+interface ApiResponse<T> {
+  success: boolean
+  data: T
+  message: string
+}
+
+export interface ChangePasswordPayload {
+  current_password: string
+  password: string
+  password_confirmation: string
+}
+
+export interface ChangeEmailPayload {
+  new_email: string
+  password: string
+  app: 'app' | 'portal' | 'admin'
+}
+
+export interface AdminChangeEmailPayload {
+  new_email: string
+}
+
+export function useChangePassword() {
+  return useMutation({
+    mutationFn: async (payload: ChangePasswordPayload) => {
+      const { data } = await apiClient.post<ApiResponse<null>>(
+        '/me/change-password',
+        payload,
+      )
+      return data
+    },
+  })
+}
+
+export function useChangeEmail() {
+  return useMutation({
+    mutationFn: async (payload: ChangeEmailPayload) => {
+      const { data } = await apiClient.post<ApiResponse<null>>(
+        '/me/change-email',
+        payload,
+      )
+      return data
+    },
+  })
+}
+
+export function useAdminChangeEmail(orgId: Ref<string>) {
+  return useMutation({
+    mutationFn: async ({ userId, newEmail }: { userId: string; newEmail: string }) => {
+      const { data } = await apiClient.post<ApiResponse<null>>(
+        `/organisations/${orgId.value}/members/${userId}/change-email`,
+        { new_email: newEmail },
+      )
+      return data
+    },
+  })
+}
diff --git a/apps/app/src/layouts/components/UserProfile.vue b/apps/app/src/layouts/components/UserProfile.vue
index 9c9d001c..148bebfa 100644
--- a/apps/app/src/layouts/components/UserProfile.vue
+++ b/apps/app/src/layouts/components/UserProfile.vue
@@ -76,6 +76,17 @@ function handleLogout() {
 
         <VDivider class="my-2" />
 
+        <VListItem :to="{ name: 'account-settings' }">
+          <template #prepend>
+            <VIcon
+              class="me-2"
+              icon="tabler-settings"
+              size="22"
+            />
+          </template>
+          <VListItemTitle>Accountinstellingen</VListItemTitle>
+        </VListItem>
+
         <VListItem
           :disabled="isLoggingOut"
           @click="handleLogout"
diff --git a/apps/app/src/pages/account-settings.vue b/apps/app/src/pages/account-settings.vue
new file mode 100644
index 00000000..4122efa5
--- /dev/null
+++ b/apps/app/src/pages/account-settings.vue
@@ -0,0 +1,221 @@
+<script setup lang="ts">
+import { useAuthStore } from '@/stores/useAuthStore'
+import { useChangePassword, useChangeEmail } from '@/composables/api/useAccount'
+
+definePage({
+  meta: {
+    navActiveLink: 'account-settings',
+  },
+})
+
+const authStore = useAuthStore()
+
+// Password change
+const passwordForm = ref({
+  current_password: '',
+  password: '',
+  password_confirmation: '',
+})
+const passwordFieldErrors = ref<Record<string, string>>({})
+const passwordSuccess = ref('')
+const showCurrentPw = ref(false)
+const showNewPw = ref(false)
+const showConfirmPw = ref(false)
+
+const changePasswordMutation = useChangePassword()
+
+async function handlePasswordChange() {
+  passwordFieldErrors.value = {}
+  passwordSuccess.value = ''
+
+  changePasswordMutation.mutate(passwordForm.value, {
+    onSuccess: (data) => {
+      passwordSuccess.value = data.message
+      passwordForm.value = {
+        current_password: '',
+        password: '',
+        password_confirmation: '',
+      }
+    },
+    onError: (err: unknown) => {
+      const ax = err as { response?: { data?: { message?: string; errors?: Record<string, string[]> } } }
+      if (ax.response?.data?.errors) {
+        for (const [key, messages] of Object.entries(ax.response.data.errors)) {
+          passwordFieldErrors.value[key] = messages[0]
+        }
+      }
+    },
+  })
+}
+
+// Email change
+const emailForm = ref({
+  new_email: '',
+  password: '',
+})
+const emailFieldErrors = ref<Record<string, string>>({})
+const emailSuccess = ref('')
+const showEmailPw = ref(false)
+
+const changeEmailMutation = useChangeEmail()
+
+async function handleEmailChange() {
+  emailFieldErrors.value = {}
+  emailSuccess.value = ''
+
+  changeEmailMutation.mutate(
+    { ...emailForm.value, app: 'app' },
+    {
+      onSuccess: (data) => {
+        emailSuccess.value = data.message
+        emailForm.value = { new_email: '', password: '' }
+      },
+      onError: (err: unknown) => {
+        const ax = err as { response?: { data?: { message?: string; errors?: Record<string, string[]> } } }
+        if (ax.response?.data?.errors) {
+          for (const [key, messages] of Object.entries(ax.response.data.errors)) {
+            emailFieldErrors.value[key] = messages[0]
+          }
+        }
+      },
+    },
+  )
+}
+</script>
+
+<template>
+  <VRow justify="center">
+    <VCol
+      cols="12"
+      md="8"
+      lg="6"
+    >
+      <h4 class="text-h4 mb-6">
+        Accountinstellingen
+      </h4>
+
+      <!-- Email change -->
+      <VCard class="mb-6">
+        <VCardTitle>E-mailadres wijzigen</VCardTitle>
+        <VCardText>
+          <p class="text-body-2 text-medium-emphasis mb-4">
+            Huidig e-mailadres: <strong>{{ authStore.user?.email }}</strong>
+          </p>
+
+          <VForm @submit.prevent="handleEmailChange">
+            <VRow>
+              <VCol cols="12">
+                <AppTextField
+                  v-model="emailForm.new_email"
+                  label="Nieuw e-mailadres"
+                  type="email"
+                  :error-messages="emailFieldErrors.new_email"
+                />
+              </VCol>
+              <VCol cols="12">
+                <AppTextField
+                  v-model="emailForm.password"
+                  label="Huidig wachtwoord"
+                  :type="showEmailPw ? 'text' : 'password'"
+                  :append-inner-icon="showEmailPw ? 'tabler-eye-off' : 'tabler-eye'"
+                  :error-messages="emailFieldErrors.password"
+                  hint="Ter bevestiging van je identiteit"
+                  persistent-hint
+                  @click:append-inner="showEmailPw = !showEmailPw"
+                />
+              </VCol>
+            </VRow>
+
+            <div class="d-flex justify-end mt-4">
+              <VBtn
+                type="submit"
+                color="primary"
+                :loading="changeEmailMutation.isPending.value"
+                :disabled="!emailForm.new_email || !emailForm.password"
+              >
+                Verificatiemail versturen
+              </VBtn>
+            </div>
+          </VForm>
+
+          <VAlert
+            v-if="emailSuccess"
+            type="success"
+            variant="tonal"
+            density="compact"
+            class="mt-4"
+          >
+            {{ emailSuccess }}
+          </VAlert>
+        </VCardText>
+      </VCard>
+
+      <!-- Password change -->
+      <VCard>
+        <VCardTitle>Wachtwoord wijzigen</VCardTitle>
+        <VCardText>
+          <VForm @submit.prevent="handlePasswordChange">
+            <VRow>
+              <VCol cols="12">
+                <AppTextField
+                  v-model="passwordForm.current_password"
+                  label="Huidig wachtwoord"
+                  :type="showCurrentPw ? 'text' : 'password'"
+                  :append-inner-icon="showCurrentPw ? 'tabler-eye-off' : 'tabler-eye'"
+                  :error-messages="passwordFieldErrors.current_password"
+                  @click:append-inner="showCurrentPw = !showCurrentPw"
+                />
+              </VCol>
+              <VCol
+                cols="12"
+                sm="6"
+              >
+                <AppTextField
+                  v-model="passwordForm.password"
+                  label="Nieuw wachtwoord"
+                  :type="showNewPw ? 'text' : 'password'"
+                  :append-inner-icon="showNewPw ? 'tabler-eye-off' : 'tabler-eye'"
+                  :error-messages="passwordFieldErrors.password"
+                  @click:append-inner="showNewPw = !showNewPw"
+                />
+              </VCol>
+              <VCol
+                cols="12"
+                sm="6"
+              >
+                <AppTextField
+                  v-model="passwordForm.password_confirmation"
+                  label="Bevestig nieuw wachtwoord"
+                  :type="showConfirmPw ? 'text' : 'password'"
+                  :append-inner-icon="showConfirmPw ? 'tabler-eye-off' : 'tabler-eye'"
+                  :error-messages="passwordFieldErrors.password_confirmation"
+                  @click:append-inner="showConfirmPw = !showConfirmPw"
+                />
+              </VCol>
+            </VRow>
+
+            <div class="d-flex justify-end mt-4">
+              <VBtn
+                type="submit"
+                color="primary"
+                :loading="changePasswordMutation.isPending.value"
+              >
+                Wachtwoord wijzigen
+              </VBtn>
+            </div>
+          </VForm>
+
+          <VAlert
+            v-if="passwordSuccess"
+            type="success"
+            variant="tonal"
+            density="compact"
+            class="mt-4"
+          >
+            {{ passwordSuccess }}
+          </VAlert>
+        </VCardText>
+      </VCard>
+    </VCol>
+  </VRow>
+</template>
diff --git a/apps/app/src/pages/forgot-password.vue b/apps/app/src/pages/forgot-password.vue
new file mode 100644
index 00000000..8e02d472
--- /dev/null
+++ b/apps/app/src/pages/forgot-password.vue
@@ -0,0 +1,163 @@
+<script setup lang="ts">
+import { useGenerateImageVariant } from '@core/composable/useGenerateImageVariant'
+import authV2ForgotPasswordIllustrationDark from '@images/pages/auth-v2-forgot-password-illustration-dark.png'
+import authV2ForgotPasswordIllustrationLight from '@images/pages/auth-v2-forgot-password-illustration-light.png'
+import authV2MaskDark from '@images/pages/misc-mask-dark.png'
+import authV2MaskLight from '@images/pages/misc-mask-light.png'
+import { VNodeRenderer } from '@layouts/components/VNodeRenderer'
+import { themeConfig } from '@themeConfig'
+import { apiClient } from '@/lib/axios'
+
+definePage({
+  meta: {
+    layout: 'blank',
+    public: true,
+  },
+})
+
+const email = ref('')
+const isSubmitting = ref(false)
+const done = ref(false)
+
+const authThemeImg = useGenerateImageVariant(
+  authV2ForgotPasswordIllustrationLight,
+  authV2ForgotPasswordIllustrationDark,
+)
+const authThemeMask = useGenerateImageVariant(authV2MaskLight, authV2MaskDark)
+
+async function onSubmit(): Promise<void> {
+  isSubmitting.value = true
+  try {
+    await apiClient.post('/auth/forgot-password', {
+      email: email.value.trim(),
+      app: 'app',
+    })
+  }
+  catch {
+    // Always show generic success (no email enumeration)
+  }
+  finally {
+    isSubmitting.value = false
+    done.value = true
+  }
+}
+</script>
+
+<template>
+  <RouterLink to="/">
+    <div class="auth-logo d-flex align-center gap-x-3">
+      <VNodeRenderer :nodes="themeConfig.app.logo" />
+      <h1 class="auth-title">
+        {{ themeConfig.app.title }}
+      </h1>
+    </div>
+  </RouterLink>
+
+  <VRow
+    class="auth-wrapper bg-surface"
+    no-gutters
+  >
+    <VCol
+      md="8"
+      class="d-none d-md-flex"
+    >
+      <div class="position-relative bg-background w-100 me-0">
+        <div
+          class="d-flex align-center justify-center w-100 h-100"
+          style="padding-inline: 150px;"
+        >
+          <VImg
+            max-width="468"
+            :src="authThemeImg"
+            class="auth-illustration mt-16 mb-2"
+          />
+        </div>
+
+        <img
+          class="auth-footer-mask flip-in-rtl"
+          :src="authThemeMask"
+          alt="auth-footer-mask"
+          height="280"
+          width="100"
+        >
+      </div>
+    </VCol>
+
+    <VCol
+      cols="12"
+      md="4"
+      class="auth-card-v2 d-flex align-center justify-center"
+    >
+      <VCard
+        flat
+        :max-width="500"
+        class="mt-12 mt-sm-0 pa-6"
+      >
+        <VCardText>
+          <h4 class="text-h4 mb-1">
+            Wachtwoord vergeten?
+          </h4>
+          <p class="mb-0">
+            Vul je e-mailadres in en we sturen je een link om je wachtwoord te herstellen.
+          </p>
+        </VCardText>
+
+        <VCardText>
+          <VAlert
+            v-if="done"
+            type="success"
+            variant="tonal"
+            class="mb-4"
+          >
+            Als dit e-mailadres bij ons bekend is, ontvang je een link om je wachtwoord te herstellen.
+          </VAlert>
+
+          <VForm
+            v-if="!done"
+            @submit.prevent="onSubmit"
+          >
+            <VRow>
+              <VCol cols="12">
+                <AppTextField
+                  v-model="email"
+                  autofocus
+                  label="E-mailadres"
+                  type="email"
+                  placeholder="naam@voorbeeld.nl"
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <VBtn
+                  block
+                  type="submit"
+                  :loading="isSubmitting"
+                >
+                  Verstuur herstelmail
+                </VBtn>
+              </VCol>
+
+              <VCol cols="12">
+                <RouterLink
+                  class="d-flex align-center justify-center"
+                  :to="{ name: 'login' }"
+                >
+                  <VIcon
+                    icon="tabler-chevron-left"
+                    size="20"
+                    class="me-1 flip-in-rtl"
+                  />
+                  <span>Terug naar inloggen</span>
+                </RouterLink>
+              </VCol>
+            </VRow>
+          </VForm>
+        </VCardText>
+      </VCard>
+    </VCol>
+  </VRow>
+</template>
+
+<style lang="scss">
+@use "@core/scss/template/pages/page-auth";
+</style>
diff --git a/apps/app/src/pages/login.vue b/apps/app/src/pages/login.vue
index fd96cae0..8d7e81fd 100644
--- a/apps/app/src/pages/login.vue
+++ b/apps/app/src/pages/login.vue
@@ -24,6 +24,8 @@ definePage({
 const route = useRoute()
 const router = useRouter()
 
+const passwordResetDone = computed(() => route.query.reset === '1')
+
 const form = ref<LoginCredentials & { remember: boolean }>({
   email: '',
   password: '',
@@ -139,13 +141,23 @@ function onSubmit() {
       >
         <VCardText>
           <h4 class="text-h4 mb-1">
-            Welcome to <span class="text-capitalize">{{ themeConfig.app.title }}</span>! 👋🏻
+            Welkom bij <span class="text-capitalize">{{ themeConfig.app.title }}</span>!
           </h4>
           <p class="mb-0">
-            Please sign-in to your account and start the adventure
+            Log in op je account om verder te gaan
           </p>
         </VCardText>
         <VCardText>
+          <VAlert
+            v-if="passwordResetDone"
+            type="success"
+            variant="tonal"
+            class="mb-4"
+            density="comfortable"
+          >
+            Wachtwoord gewijzigd. Je kunt nu inloggen.
+          </VAlert>
+
           <VForm
             ref="refVForm"
             @submit.prevent="onSubmit"
@@ -181,14 +193,14 @@ function onSubmit() {
                 <div class="d-flex align-center flex-wrap justify-space-between my-6">
                   <VCheckbox
                     v-model="form.remember"
-                    label="Remember me"
+                    label="Onthoud mij"
                   />
-                  <a
-                    class="text-primary"
-                    href="javascript:void(0)"
+                  <RouterLink
+                    class="text-primary ms-2 mb-1"
+                    :to="{ name: 'forgot-password' }"
                   >
-                    Forgot Password?
-                  </a>
+                    Wachtwoord vergeten?
+                  </RouterLink>
                 </div>
 
                 <VBtn
diff --git a/apps/app/src/pages/organisation/members.vue b/apps/app/src/pages/organisation/members.vue
index 809a05d0..7e27f95b 100644
--- a/apps/app/src/pages/organisation/members.vue
+++ b/apps/app/src/pages/organisation/members.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { useMemberList, useRemoveMember, useRevokeInvitation } from '@/composables/api/useMembers'
+import { useAdminChangeEmail } from '@/composables/api/useAccount'
 import { useAuthStore } from '@/stores/useAuthStore'
 import { useOrganisationStore } from '@/stores/useOrganisationStore'
 import InviteMemberDialog from '@/components/members/InviteMemberDialog.vue'
@@ -39,6 +40,14 @@ const isRevokeDialogOpen = ref(false)
 const invitationToRevoke = ref<{ id: string; email: string } | null>(null)
 const { mutate: revokeInvitation, isPending: isRevoking } = useRevokeInvitation(orgId)
 
+// Change email
+const isEmailChangeDialogOpen = ref(false)
+const memberToChangeEmail = ref<Member | null>(null)
+const newMemberEmail = ref('')
+const adminEmailErrors = ref<Record<string, string>>({})
+const showEmailChangeSuccess = ref(false)
+const { mutate: adminChangeEmail, isPending: isChangingMemberEmail } = useAdminChangeEmail(orgId)
+
 const showRemoveSuccess = ref(false)
 const showRevokeSuccess = ref(false)
 
@@ -115,6 +124,38 @@ function openRevokeDialog(invitation: { id: string; email: string }) {
   isRevokeDialogOpen.value = true
 }
 
+function openEmailChangeDialog(member: Member) {
+  memberToChangeEmail.value = member
+  newMemberEmail.value = ''
+  adminEmailErrors.value = {}
+  isEmailChangeDialogOpen.value = true
+}
+
+function confirmEmailChange() {
+  if (!memberToChangeEmail.value) return
+  adminEmailErrors.value = {}
+
+  adminChangeEmail(
+    { userId: memberToChangeEmail.value.id, newEmail: newMemberEmail.value },
+    {
+      onSuccess: () => {
+        isEmailChangeDialogOpen.value = false
+        memberToChangeEmail.value = null
+        newMemberEmail.value = ''
+        showEmailChangeSuccess.value = true
+      },
+      onError: (err: unknown) => {
+        const ax = err as { response?: { data?: { errors?: Record<string, string[]> } } }
+        if (ax.response?.data?.errors) {
+          for (const [key, messages] of Object.entries(ax.response.data.errors)) {
+            adminEmailErrors.value[key] = messages[0]
+          }
+        }
+      },
+    },
+  )
+}
+
 function confirmRevokeInvitation() {
   if (!invitationToRevoke.value) return
 
@@ -223,6 +264,12 @@ function confirmRevokeInvitation() {
                 size="small"
                 @click="openEditRole(item)"
               />
+              <VBtn
+                icon="tabler-mail-forward"
+                variant="text"
+                size="small"
+                @click="openEmailChangeDialog(item)"
+              />
               <VBtn
                 icon="tabler-trash"
                 variant="text"
@@ -354,6 +401,44 @@ function confirmRevokeInvitation() {
       </VCard>
     </VDialog>
 
+    <!-- Change email dialog -->
+    <VDialog
+      v-model="isEmailChangeDialogOpen"
+      max-width="420"
+    >
+      <VCard title="E-mailadres wijzigen">
+        <VCardText>
+          <p class="text-body-2 text-medium-emphasis mb-4">
+            Wijzig het e-mailadres van <strong>{{ memberToChangeEmail?.full_name }}</strong>.
+            Er wordt een verificatiemail verstuurd naar het nieuwe adres.
+          </p>
+          <AppTextField
+            v-model="newMemberEmail"
+            label="Nieuw e-mailadres"
+            type="email"
+            :error-messages="adminEmailErrors.new_email"
+          />
+        </VCardText>
+        <VCardActions>
+          <VSpacer />
+          <VBtn
+            variant="tonal"
+            @click="isEmailChangeDialogOpen = false"
+          >
+            Annuleren
+          </VBtn>
+          <VBtn
+            color="primary"
+            :loading="isChangingMemberEmail"
+            :disabled="!newMemberEmail"
+            @click="confirmEmailChange"
+          >
+            Verificatiemail versturen
+          </VBtn>
+        </VCardActions>
+      </VCard>
+    </VDialog>
+
     <!-- Success snackbars -->
     <VSnackbar
       v-model="showRemoveSuccess"
@@ -369,5 +454,12 @@ function confirmRevokeInvitation() {
     >
       Uitnodiging ingetrokken
     </VSnackbar>
+    <VSnackbar
+      v-model="showEmailChangeSuccess"
+      color="success"
+      :timeout="4000"
+    >
+      Verificatiemail verstuurd
+    </VSnackbar>
   </div>
 </template>
diff --git a/apps/app/src/pages/reset-password.vue b/apps/app/src/pages/reset-password.vue
new file mode 100644
index 00000000..7096b38a
--- /dev/null
+++ b/apps/app/src/pages/reset-password.vue
@@ -0,0 +1,202 @@
+<script setup lang="ts">
+import { useGenerateImageVariant } from '@core/composable/useGenerateImageVariant'
+import authV2ResetPasswordIllustrationDark from '@images/pages/auth-v2-reset-password-illustration-dark.png'
+import authV2ResetPasswordIllustrationLight from '@images/pages/auth-v2-reset-password-illustration-light.png'
+import authV2MaskDark from '@images/pages/misc-mask-dark.png'
+import authV2MaskLight from '@images/pages/misc-mask-light.png'
+import { VNodeRenderer } from '@layouts/components/VNodeRenderer'
+import { themeConfig } from '@themeConfig'
+import { apiClient } from '@/lib/axios'
+
+definePage({
+  meta: {
+    layout: 'blank',
+    public: true,
+  },
+})
+
+const route = useRoute()
+const router = useRouter()
+
+const email = ref(typeof route.query.email === 'string' ? route.query.email : '')
+const token = ref(typeof route.query.token === 'string' ? route.query.token : '')
+const password = ref('')
+const passwordConfirmation = ref('')
+const showPassword = ref(false)
+const showPasswordConfirmation = ref(false)
+
+const errorMessage = ref('')
+const isSubmitting = ref(false)
+
+const authThemeImg = useGenerateImageVariant(
+  authV2ResetPasswordIllustrationLight,
+  authV2ResetPasswordIllustrationDark,
+)
+const authThemeMask = useGenerateImageVariant(authV2MaskLight, authV2MaskDark)
+
+async function onSubmit(): Promise<void> {
+  errorMessage.value = ''
+  if (!token.value || !email.value) {
+    errorMessage.value = 'Ongeldige resetlink. Vraag een nieuwe link aan.'
+    return
+  }
+  isSubmitting.value = true
+  try {
+    await apiClient.post('/auth/reset-password', {
+      email: email.value.trim(),
+      password: password.value,
+      password_confirmation: passwordConfirmation.value,
+      token: token.value,
+    })
+    await router.replace({ path: '/login', query: { reset: '1' } })
+  }
+  catch (error: unknown) {
+    const ax = error as { response?: { status?: number; data?: { message?: string } } }
+    if (ax.response?.status === 404 || ax.response?.status === 422)
+      errorMessage.value = ax.response?.data?.message ?? 'Resetlink ongeldig of verlopen. Vraag een nieuwe link aan.'
+    else
+      errorMessage.value = 'Er ging iets mis. Probeer het later opnieuw.'
+  }
+  finally {
+    isSubmitting.value = false
+  }
+}
+</script>
+
+<template>
+  <RouterLink to="/">
+    <div class="auth-logo d-flex align-center gap-x-3">
+      <VNodeRenderer :nodes="themeConfig.app.logo" />
+      <h1 class="auth-title">
+        {{ themeConfig.app.title }}
+      </h1>
+    </div>
+  </RouterLink>
+
+  <VRow
+    class="auth-wrapper bg-surface"
+    no-gutters
+  >
+    <VCol
+      md="8"
+      class="d-none d-md-flex"
+    >
+      <div class="position-relative bg-background w-100 me-0">
+        <div
+          class="d-flex align-center justify-center w-100 h-100"
+          style="padding-inline: 150px;"
+        >
+          <VImg
+            max-width="468"
+            :src="authThemeImg"
+            class="auth-illustration mt-16 mb-2"
+          />
+        </div>
+
+        <img
+          class="auth-footer-mask flip-in-rtl"
+          :src="authThemeMask"
+          alt="auth-footer-mask"
+          height="280"
+          width="100"
+        >
+      </div>
+    </VCol>
+
+    <VCol
+      cols="12"
+      md="4"
+      class="auth-card-v2 d-flex align-center justify-center"
+    >
+      <VCard
+        flat
+        :max-width="500"
+        class="mt-12 mt-sm-0 pa-6"
+      >
+        <VCardText>
+          <h4 class="text-h4 mb-1">
+            Nieuw wachtwoord instellen
+          </h4>
+          <p class="mb-0">
+            Kies een nieuw wachtwoord voor je account.
+          </p>
+        </VCardText>
+
+        <VCardText>
+          <VAlert
+            v-if="errorMessage"
+            type="error"
+            variant="tonal"
+            class="mb-4"
+          >
+            {{ errorMessage }}
+          </VAlert>
+
+          <VForm @submit.prevent="onSubmit">
+            <VRow>
+              <VCol cols="12">
+                <AppTextField
+                  v-model="email"
+                  label="E-mailadres"
+                  type="email"
+                  readonly
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <AppTextField
+                  v-model="password"
+                  label="Nieuw wachtwoord"
+                  autofocus
+                  :type="showPassword ? 'text' : 'password'"
+                  :append-inner-icon="showPassword ? 'tabler-eye-off' : 'tabler-eye'"
+                  autocomplete="new-password"
+                  @click:append-inner="showPassword = !showPassword"
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <AppTextField
+                  v-model="passwordConfirmation"
+                  label="Bevestig wachtwoord"
+                  :type="showPasswordConfirmation ? 'text' : 'password'"
+                  :append-inner-icon="showPasswordConfirmation ? 'tabler-eye-off' : 'tabler-eye'"
+                  autocomplete="new-password"
+                  @click:append-inner="showPasswordConfirmation = !showPasswordConfirmation"
+                />
+              </VCol>
+
+              <VCol cols="12">
+                <VBtn
+                  block
+                  type="submit"
+                  :loading="isSubmitting"
+                >
+                  Wachtwoord opslaan
+                </VBtn>
+              </VCol>
+
+              <VCol cols="12">
+                <RouterLink
+                  class="d-flex align-center justify-center"
+                  :to="{ name: 'login' }"
+                >
+                  <VIcon
+                    icon="tabler-chevron-left"
+                    size="20"
+                    class="me-1 flip-in-rtl"
+                  />
+                  <span>Terug naar inloggen</span>
+                </RouterLink>
+              </VCol>
+            </VRow>
+          </VForm>
+        </VCardText>
+      </VCard>
+    </VCol>
+  </VRow>
+</template>
+
+<style lang="scss">
+@use "@core/scss/template/pages/page-auth";
+</style>
diff --git a/apps/app/src/pages/verify-email-change.vue b/apps/app/src/pages/verify-email-change.vue
new file mode 100644
index 00000000..3caf8a17
--- /dev/null
+++ b/apps/app/src/pages/verify-email-change.vue
@@ -0,0 +1,116 @@
+<script setup lang="ts">
+import { VNodeRenderer } from '@layouts/components/VNodeRenderer'
+import { themeConfig } from '@themeConfig'
+import { apiClient } from '@/lib/axios'
+import { useAuthStore } from '@/stores/useAuthStore'
+
+definePage({
+  meta: {
+    layout: 'blank',
+    public: true,
+  },
+})
+
+const route = useRoute()
+const authStore = useAuthStore()
+
+const isVerifying = ref(true)
+const success = ref(false)
+const errorMessage = ref('')
+
+onMounted(async () => {
+  const token = route.query.token as string
+  if (!token) {
+    errorMessage.value = 'Geen verificatietoken gevonden.'
+    isVerifying.value = false
+    return
+  }
+  try {
+    await apiClient.post('/verify-email-change', { token })
+    success.value = true
+    authStore.logout()
+  }
+  catch (error: unknown) {
+    const ax = error as { response?: { data?: { errors?: Record<string, string[]>; message?: string } } }
+    errorMessage.value = ax.response?.data?.errors?.token?.[0]
+      ?? ax.response?.data?.errors?.new_email?.[0]
+      ?? ax.response?.data?.message
+      ?? 'Er is een fout opgetreden bij de verificatie.'
+  }
+  finally {
+    isVerifying.value = false
+  }
+})
+</script>
+
+<template>
+  <div class="auth-wrapper d-flex align-center justify-center pa-4 bg-surface" style="min-height: 100vh;">
+    <div class="auth-logo d-flex align-center gap-x-3 position-absolute" style="inset-block-start: 2rem; inset-inline-start: 2.5rem;">
+      <VNodeRenderer :nodes="themeConfig.app.logo" />
+      <h1 class="auth-title">
+        {{ themeConfig.app.title }}
+      </h1>
+    </div>
+
+    <VCard
+      flat
+      :max-width="450"
+      width="100%"
+      class="pa-6"
+    >
+      <VCardText class="text-center">
+        <template v-if="isVerifying">
+          <VProgressCircular
+            indeterminate
+            color="primary"
+            class="mb-4"
+          />
+          <p>E-mailadres wordt geverifieerd...</p>
+        </template>
+
+        <template v-else-if="success">
+          <VIcon
+            size="64"
+            color="success"
+            class="mb-4"
+          >
+            tabler-circle-check
+          </VIcon>
+          <h4 class="text-h5 mb-2">
+            E-mailadres gewijzigd!
+          </h4>
+          <p class="text-body-2 text-medium-emphasis mb-4">
+            Je e-mailadres is succesvol gewijzigd.
+            Log opnieuw in met je nieuwe e-mailadres.
+          </p>
+          <VBtn
+            color="primary"
+            :to="{ name: 'login' }"
+          >
+            Ga naar inloggen
+          </VBtn>
+        </template>
+
+        <template v-else>
+          <VIcon
+            size="64"
+            color="error"
+            class="mb-4"
+          >
+            tabler-circle-x
+          </VIcon>
+          <h4 class="text-h5 mb-2">
+            Verificatie mislukt
+          </h4>
+          <p class="text-body-2 text-medium-emphasis">
+            {{ errorMessage }}
+          </p>
+        </template>
+      </VCardText>
+    </VCard>
+  </div>
+</template>
+
+<style lang="scss">
+@use "@core/scss/template/pages/page-auth";
+</style>
diff --git a/apps/app/src/plugins/1.router/guards.ts b/apps/app/src/plugins/1.router/guards.ts
index 9d11b131..a05f23ce 100644
--- a/apps/app/src/plugins/1.router/guards.ts
+++ b/apps/app/src/plugins/1.router/guards.ts
@@ -13,9 +13,10 @@ export function setupGuards(router: Router) {
 
     const isPublic = to.meta.public === true
 
-    // Allow public routes (login, 404) — but redirect authenticated users away from login
+    // Allow public routes (login, auth pages, 404) — but redirect authenticated users away from login
     if (isPublic) {
-      if (authStore.isAuthenticated && to.path === '/login') {
+      const guestOnlyPaths = ['/login', '/forgot-password', '/reset-password', '/verify-email-change']
+      if (authStore.isAuthenticated && guestOnlyPaths.some(p => to.path === p)) {
         return { name: 'dashboard' }
       }
       return
diff --git a/apps/app/typed-router.d.ts b/apps/app/typed-router.d.ts
index 6cacb786..1b9ac509 100644
--- a/apps/app/typed-router.d.ts
+++ b/apps/app/typed-router.d.ts
@@ -20,6 +20,7 @@ declare module 'vue-router/auto-routes' {
   export interface RouteNamedMap {
     'root': RouteRecordInfo<'root', '/', Record<never, never>, Record<never, never>>,
     '$error': RouteRecordInfo<'$error', '/:error(.*)', { error: ParamValue<true> }, { error: ParamValue<false> }>,
+    'account-settings': RouteRecordInfo<'account-settings', '/account-settings', Record<never, never>, Record<never, never>>,
     'dashboard': RouteRecordInfo<'dashboard', '/dashboard', Record<never, never>, Record<never, never>>,
     'events': RouteRecordInfo<'events', '/events', Record<never, never>, Record<never, never>>,
     'events-id': RouteRecordInfo<'events-id', '/events/:id', { id: ParamValue<true> }, { id: ParamValue<false> }>,
@@ -32,12 +33,15 @@ declare module 'vue-router/auto-routes' {
     'events-id-settings': RouteRecordInfo<'events-id-settings', '/events/:id/settings', { id: ParamValue<true> }, { id: ParamValue<false> }>,
     'events-id-settings-registration-fields': RouteRecordInfo<'events-id-settings-registration-fields', '/events/:id/settings/registration-fields', { id: ParamValue<true> }, { id: ParamValue<false> }>,
     'events-id-time-slots': RouteRecordInfo<'events-id-time-slots', '/events/:id/time-slots', { id: ParamValue<true> }, { id: ParamValue<false> }>,
+    'forgot-password': RouteRecordInfo<'forgot-password', '/forgot-password', Record<never, never>, Record<never, never>>,
     'invitations-token': RouteRecordInfo<'invitations-token', '/invitations/:token', { token: ParamValue<true> }, { token: ParamValue<false> }>,
     'login': RouteRecordInfo<'login', '/login', Record<never, never>, Record<never, never>>,
     'organisation': RouteRecordInfo<'organisation', '/organisation', Record<never, never>, Record<never, never>>,
     'organisation-companies': RouteRecordInfo<'organisation-companies', '/organisation/companies', Record<never, never>, Record<never, never>>,
     'organisation-members': RouteRecordInfo<'organisation-members', '/organisation/members', Record<never, never>, Record<never, never>>,
     'organisation-settings': RouteRecordInfo<'organisation-settings', '/organisation/settings', Record<never, never>, Record<never, never>>,
+    'reset-password': RouteRecordInfo<'reset-password', '/reset-password', Record<never, never>, Record<never, never>>,
     'select-organisation': RouteRecordInfo<'select-organisation', '/select-organisation', Record<never, never>, Record<never, never>>,
+    'verify-email-change': RouteRecordInfo<'verify-email-change', '/verify-email-change', Record<never, never>, Record<never, never>>,
   }
 }
diff --git a/apps/portal/src/lib/axios.ts b/apps/portal/src/lib/axios.ts
index ddb5b35a..bc3bb0fc 100644
--- a/apps/portal/src/lib/axios.ts
+++ b/apps/portal/src/lib/axios.ts
@@ -53,7 +53,7 @@ apiClient.interceptors.response.use(
 
         if (typeof window !== 'undefined') {
           const path = window.location.pathname
-          const publicPaths = ['/login', '/wachtwoord-vergeten', '/wachtwoord-resetten']
+          const publicPaths = ['/login', '/wachtwoord-vergeten', '/wachtwoord-resetten', '/verify-email-change']
           if (!publicPaths.some(p => path.startsWith(p)) && !path.startsWith('/register')) {
             window.location.href = '/login'
           }
diff --git a/apps/portal/src/pages/profiel.vue b/apps/portal/src/pages/profiel.vue
index 77a4d075..ed0df2bc 100644
--- a/apps/portal/src/pages/profiel.vue
+++ b/apps/portal/src/pages/profiel.vue
@@ -2,6 +2,7 @@
 import { useAuthStore } from '@/stores/useAuthStore'
 import { usePortalStore } from '@/stores/usePortalStore'
 import { useUpdateProfile, useUpdatePassword } from '@/composables/api/usePortalProfile'
+import { apiClient } from '@/lib/axios'
 
 definePage({
   name: 'portal-profiel',
@@ -33,6 +34,49 @@ const profileForm = ref({
 })
 const profileError = ref<string | null>(null)
 
+// Email change form
+const showEmailChange = ref(false)
+const emailForm = ref({
+  new_email: '',
+  password: '',
+})
+const emailError = ref<string | null>(null)
+const emailFieldErrors = ref<Record<string, string>>({})
+const emailSuccess = ref('')
+const showEmailPw = ref(false)
+const isChangingEmail = ref(false)
+
+async function saveEmail() {
+  emailError.value = null
+  emailFieldErrors.value = {}
+  emailSuccess.value = ''
+  isChangingEmail.value = true
+
+  try {
+    const { data } = await apiClient.post<{ success: boolean; message: string }>(
+      '/me/change-email',
+      { ...emailForm.value, app: 'portal' },
+    )
+    emailSuccess.value = data.message
+    emailForm.value = { new_email: '', password: '' }
+    showEmailChange.value = false
+  }
+  catch (err: unknown) {
+    const ax = err as { response?: { data?: { message?: string; errors?: Record<string, string[]> } } }
+    if (ax.response?.data?.errors) {
+      for (const [key, messages] of Object.entries(ax.response.data.errors)) {
+        emailFieldErrors.value[key] = (messages as string[])[0]
+      }
+    }
+    else {
+      emailError.value = ax.response?.data?.message ?? 'Er is een fout opgetreden.'
+    }
+  }
+  finally {
+    isChangingEmail.value = false
+  }
+}
+
 // Password form
 const passwordForm = ref({
   current_password: '',
@@ -224,11 +268,90 @@ async function savePassword() {
                   density="comfortable"
                   hide-details="auto"
                   readonly
-                  prepend-inner-icon="tabler-lock"
+                  prepend-inner-icon="tabler-mail"
                 />
-                <p class="text-caption text-medium-emphasis mt-1 mb-0">
-                  Je e-mailadres kan niet worden gewijzigd.
-                </p>
+                <div class="d-flex align-center justify-space-between mt-1">
+                  <p class="text-caption text-medium-emphasis mb-0">
+                    {{ showEmailChange ? '' : 'Je kunt je e-mailadres hieronder wijzigen.' }}
+                  </p>
+                  <VBtn
+                    v-if="!showEmailChange"
+                    variant="text"
+                    color="primary"
+                    size="small"
+                    @click="showEmailChange = true"
+                  >
+                    E-mail wijzigen
+                  </VBtn>
+                </div>
+              </VCol>
+
+              <!-- Email change form -->
+              <template v-if="showEmailChange">
+                <VCol cols="12">
+                  <VAlert
+                    v-if="emailError"
+                    type="error"
+                    variant="tonal"
+                    density="compact"
+                    class="mb-3"
+                  >
+                    {{ emailError }}
+                  </VAlert>
+
+                  <VTextField
+                    v-model="emailForm.new_email"
+                    label="Nieuw e-mailadres"
+                    type="email"
+                    variant="outlined"
+                    density="comfortable"
+                    hide-details="auto"
+                    :error-messages="emailFieldErrors.new_email"
+                    class="mb-3"
+                  />
+                  <VTextField
+                    v-model="emailForm.password"
+                    label="Huidig wachtwoord"
+                    :type="showEmailPw ? 'text' : 'password'"
+                    :append-inner-icon="showEmailPw ? 'tabler-eye-off' : 'tabler-eye'"
+                    variant="outlined"
+                    density="comfortable"
+                    hide-details="auto"
+                    :error-messages="emailFieldErrors.password"
+                    @click:append-inner="showEmailPw = !showEmailPw"
+                  />
+                  <div class="d-flex gap-2 mt-3">
+                    <VBtn
+                      color="primary"
+                      size="small"
+                      :loading="isChangingEmail"
+                      :disabled="!emailForm.new_email || !emailForm.password"
+                      @click="saveEmail"
+                    >
+                      Verificatiemail versturen
+                    </VBtn>
+                    <VBtn
+                      variant="tonal"
+                      size="small"
+                      @click="showEmailChange = false; emailForm = { new_email: '', password: '' }"
+                    >
+                      Annuleren
+                    </VBtn>
+                  </div>
+                </VCol>
+              </template>
+
+              <VCol
+                v-if="emailSuccess"
+                cols="12"
+              >
+                <VAlert
+                  type="success"
+                  variant="tonal"
+                  density="compact"
+                >
+                  {{ emailSuccess }}
+                </VAlert>
               </VCol>
               <VCol
                 cols="12"
diff --git a/apps/portal/src/pages/verify-email-change.vue b/apps/portal/src/pages/verify-email-change.vue
new file mode 100644
index 00000000..0c66e767
--- /dev/null
+++ b/apps/portal/src/pages/verify-email-change.vue
@@ -0,0 +1,114 @@
+<script setup lang="ts">
+import { apiClient } from '@/lib/axios'
+import { useAuthStore } from '@/stores/useAuthStore'
+
+definePage({
+  name: 'verify-email-change',
+  meta: {
+    layout: 'blank',
+    requiresAuth: false,
+  },
+})
+
+const route = useRoute()
+const authStore = useAuthStore()
+
+const isVerifying = ref(true)
+const success = ref(false)
+const errorMessage = ref('')
+
+onMounted(async () => {
+  const token = route.query.token as string
+  if (!token) {
+    errorMessage.value = 'Geen verificatietoken gevonden.'
+    isVerifying.value = false
+    return
+  }
+  try {
+    await apiClient.post('/verify-email-change', { token })
+    success.value = true
+    authStore.logout()
+  }
+  catch (error: unknown) {
+    const ax = error as { response?: { data?: { errors?: Record<string, string[]>; message?: string } } }
+    errorMessage.value = ax.response?.data?.errors?.token?.[0]
+      ?? ax.response?.data?.errors?.new_email?.[0]
+      ?? ax.response?.data?.message
+      ?? 'Er is een fout opgetreden bij de verificatie.'
+  }
+  finally {
+    isVerifying.value = false
+  }
+})
+</script>
+
+<template>
+  <div class="d-flex align-center justify-center pa-4" style="min-height: 100vh; background: #f5f5f5;">
+    <VCard
+      :max-width="450"
+      width="100%"
+      class="pa-6"
+    >
+      <div class="text-center mb-4">
+        <VIcon
+          icon="tabler-users-group"
+          size="32"
+          color="primary"
+        />
+        <span class="text-h5 font-weight-bold text-high-emphasis ms-2">
+          Crewli
+        </span>
+      </div>
+
+      <VCardText class="text-center">
+        <template v-if="isVerifying">
+          <VProgressCircular
+            indeterminate
+            color="primary"
+            class="mb-4"
+          />
+          <p>E-mailadres wordt geverifieerd...</p>
+        </template>
+
+        <template v-else-if="success">
+          <VIcon
+            size="64"
+            color="success"
+            class="mb-4"
+          >
+            tabler-circle-check
+          </VIcon>
+          <h4 class="text-h5 mb-2">
+            E-mailadres gewijzigd!
+          </h4>
+          <p class="text-body-2 text-medium-emphasis mb-4">
+            Je e-mailadres is succesvol gewijzigd.
+            Log opnieuw in met je nieuwe e-mailadres.
+          </p>
+          <VBtn
+            color="primary"
+            to="/login"
+          >
+            Ga naar inloggen
+          </VBtn>
+        </template>
+
+        <template v-else>
+          <VIcon
+            size="64"
+            color="error"
+            class="mb-4"
+          >
+            tabler-circle-x
+          </VIcon>
+          <h4 class="text-h5 mb-2">
+            Verificatie mislukt
+          </h4>
+          <p class="text-body-2 text-medium-emphasis">
+            {{ errorMessage }}
+          </p>
+        </template>
+      </VCardText>
+    </VCard>
+  </div>
+</template>
diff --git a/apps/portal/src/pages/wachtwoord-vergeten.vue b/apps/portal/src/pages/wachtwoord-vergeten.vue
index 2cc13757..51eeb2ed 100644
--- a/apps/portal/src/pages/wachtwoord-vergeten.vue
+++ b/apps/portal/src/pages/wachtwoord-vergeten.vue
@@ -16,7 +16,7 @@ const done = ref(false)
 async function onSubmit(): Promise<void> {
   isSubmitting.value = true
   try {
-    await apiClient.post('/auth/forgot-password', { email: email.value.trim() })
+    await apiClient.post('/auth/forgot-password', { email: email.value.trim(), app: 'portal' })
   }
   catch {
     // Endpoint may not exist yet — still show generic success (no email enumeration)
diff --git a/apps/portal/src/plugins/1.router/guards.ts b/apps/portal/src/plugins/1.router/guards.ts
index 03fa00ec..084b5ca6 100644
--- a/apps/portal/src/plugins/1.router/guards.ts
+++ b/apps/portal/src/plugins/1.router/guards.ts
@@ -2,7 +2,7 @@ import type { Router } from 'vue-router'
 import { useAuthStore } from '@/stores/useAuthStore'
 import { usePortalStore } from '@/stores/usePortalStore'
 
-const guestOnlyPaths = ['/login', '/wachtwoord-vergeten', '/wachtwoord-resetten']
+const guestOnlyPaths = ['/login', '/wachtwoord-vergeten', '/wachtwoord-resetten', '/verify-email-change']
 
 // Old dashboard routes that need backward-compat redirects
 const dashboardRedirects: Record<string, string> = {
diff --git a/apps/portal/typed-router.d.ts b/apps/portal/typed-router.d.ts
index 1c9f7328..0ff7002b 100644
--- a/apps/portal/typed-router.d.ts
+++ b/apps/portal/typed-router.d.ts
@@ -29,6 +29,7 @@ declare module 'vue-router/auto-routes' {
     'register-success': RouteRecordInfo<'register-success', '/register/success', Record<never, never>, Record<never, never>>,
     'volunteer-register-info': RouteRecordInfo<'volunteer-register-info', '/registreren', Record<never, never>, Record<never, never>>,
     'portal-shifts': RouteRecordInfo<'portal-shifts', '/shifts', Record<never, never>, Record<never, never>>,
+    'verify-email-change': RouteRecordInfo<'verify-email-change', '/verify-email-change', Record<never, never>, Record<never, never>>,
     'reset-password': RouteRecordInfo<'reset-password', '/wachtwoord-resetten', Record<never, never>, Record<never, never>>,
     'forgot-password': RouteRecordInfo<'forgot-password', '/wachtwoord-vergeten', Record<never, never>, Record<never, never>>,
   }
diff --git a/dev-docs/API.md b/dev-docs/API.md
index c0054b4a..871048c4 100644
--- a/dev-docs/API.md
+++ b/dev-docs/API.md
@@ -9,6 +9,14 @@ Auth: Bearer token (Sanctum)
 - `POST /auth/login`
 - `POST /auth/logout`
 - `GET /auth/me`
+- `POST /auth/forgot-password` — request password reset (public, rate-limited). Body: `{ email, app: "app"|"portal"|"admin" }`. Always returns 200 (no email enumeration).
+- `POST /auth/reset-password` — reset password with token (public). Body: `{ token, email, password, password_confirmation }`.
+
+## Account Management (authenticated)
+
+- `POST /me/change-password` — change own password. Body: `{ current_password, password, password_confirmation }`. Revokes other sessions.
+- `POST /me/change-email` — request email change (sends verification to new address). Body: `{ new_email, password, app: "app"|"portal"|"admin" }`.
+- `POST /verify-email-change` — verify email change token (public). Body: `{ token }`. Revokes all sessions.
 
 ## Organisations
 
@@ -18,6 +26,7 @@ Auth: Bearer token (Sanctum)
 - `PUT /organisations/{org}` — update
 - `GET /organisations/{org}/members` — members
 - `POST /organisations/{org}/invite` — invite user
+- `POST /organisations/{org}/members/{user}/change-email` — admin initiates email change for a member (org_admin only). Body: `{ new_email }`.
 
 ## Events
 
diff --git a/dev-docs/SCHEMA.md b/dev-docs/SCHEMA.md
index 27c01a46..7a3c8b7f 100644
--- a/dev-docs/SCHEMA.md
+++ b/dev-docs/SCHEMA.md
@@ -243,6 +243,26 @@ scopeFestivals()    // WHERE event_type IN ('festival', 'series')
 
 ---
 
+### `email_change_requests`
+
+| Column                 | Type         | Notes                             |
+| ---------------------- | ------------ | --------------------------------- |
+| `id`                   | ULID PK      |                                   |
+| `user_id`              | ULID FK      | → users (cascade delete)          |
+| `current_email`        | string       | Email at time of request          |
+| `new_email`            | string       | Requested new email               |
+| `token`                | string       | SHA-256 hashed verification token |
+| `requested_by_user_id` | ULID FK null | → users (null on delete) — self or admin |
+| `status`               | string       | pending / verified / expired / cancelled |
+| `expires_at`           | timestamp    | 24h from request                  |
+| `verified_at`          | timestamp?   | When verification completed       |
+| `created_at`           | timestamp    |                                   |
+| `updated_at`           | timestamp    |                                   |
+
+**Indexes:** `(user_id, status)`, `(token)`
+
+---
+
 ## 3.5.2 Locations
 
 > Locations are event-scoped and reusable across sections within an event.