diff --git a/src/cli/repo/s3_e2e_test.go b/src/cli/repo/s3_e2e_test.go
index 0bca84ca6..99987985c 100644
--- a/src/cli/repo/s3_e2e_test.go
+++ b/src/cli/repo/s3_e2e_test.go
@@ -289,3 +289,80 @@ func (suite *S3E2ESuite) TestConnectS3Cmd_BadPrefix() {
 	err = cmd.ExecuteContext(ctx)
 	require.Error(t, err, clues.ToCore(err))
 }
+
+func (suite *S3E2ESuite) TestUpdateS3Cmd() {
+	t := suite.T()
+	ctx, flush := tester.NewContext(t)
+
+	defer flush()
+
+	st := storeTD.NewPrefixedS3Storage(t)
+	sc, err := st.StorageConfig()
+	require.NoError(t, err, clues.ToCore(err))
+
+	cfg := sc.(*storage.S3Config)
+
+	vpr, configFP := tconfig.MakeTempTestConfigClone(t, nil)
+
+	ctx = config.SetViper(ctx, vpr)
+
+	cmd := cliTD.StubRootCmd(
+		"repo", "init", "s3",
+		"--config-file", configFP,
+		"--prefix", cfg.Prefix)
+
+	cli.BuildCommandTree(cmd)
+
+	// run the command
+	err = cmd.ExecuteContext(ctx)
+	require.NoError(t, err, clues.ToCore(err))
+
+	// connect with old passphrase
+	cmd = cliTD.StubRootCmd(
+		"repo", "connect", "s3",
+		"--config-file", configFP,
+		"--bucket", cfg.Bucket,
+		"--prefix", cfg.Prefix)
+	cli.BuildCommandTree(cmd)
+
+	// run the command
+	err = cmd.ExecuteContext(ctx)
+	require.NoError(t, err, clues.ToCore(err))
+
+	cmd = cliTD.StubRootCmd(
+		"repo", "update", "s3",
+		"--config-file", configFP,
+		"--bucket", cfg.Bucket,
+		"--prefix", cfg.Prefix,
+		"--update-passphrase", "newpass")
+	cli.BuildCommandTree(cmd)
+
+	// run the command
+	err = cmd.ExecuteContext(ctx)
+	require.NoError(t, err, clues.ToCore(err))
+
+	// connect again with new passphrase
+	cmd = cliTD.StubRootCmd(
+		"repo", "connect", "s3",
+		"--config-file", configFP,
+		"--bucket", cfg.Bucket,
+		"--prefix", cfg.Prefix,
+		"--passphrase", "newpass")
+	cli.BuildCommandTree(cmd)
+
+	// run the command
+	err = cmd.ExecuteContext(ctx)
+	require.NoError(t, err, clues.ToCore(err))
+
+	// connect with old passphrase - it will fail
+	cmd = cliTD.StubRootCmd(
+		"repo", "connect", "s3",
+		"--config-file", configFP,
+		"--bucket", cfg.Bucket,
+		"--prefix", cfg.Prefix)
+	cli.BuildCommandTree(cmd)
+
+	// run the command
+	err = cmd.ExecuteContext(ctx)
+	require.Error(t, err, clues.ToCore(err))
+}
diff --git a/src/cli/repo/s3_test.go b/src/cli/repo/s3_test.go
index 5e81b778a..90f75c6c2 100644
--- a/src/cli/repo/s3_test.go
+++ b/src/cli/repo/s3_test.go
@@ -31,6 +31,7 @@ func (suite *S3Suite) TestAddS3Commands() {
 	}{
 		{"init s3", initCommand, expectUse, s3InitCmd().Short, initS3Cmd},
 		{"connect s3", connectCommand, expectUse, s3ConnectCmd().Short, connectS3Cmd},
+		{"update s3", updateCommand, expectUse, s3UpdateCmd().Short, updateS3Cmd},
 	}
 	for _, test := range table {
 		suite.Run(test.name, func() {
diff --git a/src/pkg/repository/repository.go b/src/pkg/repository/repository.go
index 1b4b00344..78fad37df 100644
--- a/src/pkg/repository/repository.go
+++ b/src/pkg/repository/repository.go
@@ -295,6 +295,8 @@ func (r *repository) UpdatePassword(ctx context.Context, password string) (err e
 		return clues.Wrap(err, "connecting kopia client")
 	}
 
+	defer kopiaRef.Close(ctx)
+
 	repository := kopiaRef.Repository.(repo.DirectRepository)
 	err = repository.FormatManager().ChangePassword(ctx, password)
 
@@ -302,10 +304,6 @@ func (r *repository) UpdatePassword(ctx context.Context, password string) (err e
 		return errors.Wrap(err, "unable to update password")
 	}
 
-	// kopiaRef comes with a count of 1 and NewWrapper/NewModelStore bumps it again so safe
-	// to close here.
-	defer kopiaRef.Close(ctx)
-
 	r.Bus.Event(ctx, events.RepoUpdate, nil)
 
 	return nil
diff --git a/src/pkg/repository/repository_test.go b/src/pkg/repository/repository_test.go
index c276f35f5..9d9125030 100644
--- a/src/pkg/repository/repository_test.go
+++ b/src/pkg/repository/repository_test.go
@@ -236,6 +236,37 @@ func (suite *RepositoryIntegrationSuite) TestConnect() {
 	assert.NoError(t, err, clues.ToCore(err))
 }
 
+func (suite *RepositoryIntegrationSuite) TestUpdate() {
+	t := suite.T()
+
+	ctx, flush := tester.NewContext(t)
+	defer flush()
+
+	// need to initialize the repository before we can test connecting to it.
+	st := storeTD.NewPrefixedS3Storage(t)
+	r, err := New(
+		ctx,
+		account.Account{},
+		st,
+		control.DefaultOptions(),
+		NewRepoID)
+	require.NoError(t, err, clues.ToCore(err))
+
+	err = r.Initialize(ctx, ctrlRepo.Retention{})
+	require.NoError(t, err, clues.ToCore(err))
+
+	// now re-connect
+	err = r.Connect(ctx)
+	assert.NoError(t, err, clues.ToCore(err))
+
+	err = r.UpdatePassword(ctx, "newpass")
+	require.NoError(t, err, clues.ToCore(err))
+
+	// now reconnect with new pass
+	err = r.Connect(ctx)
+	assert.Error(t, err, clues.ToCore(err))
+}
+
 func (suite *RepositoryIntegrationSuite) TestConnect_sameID() {
 	t := suite.T()