diff --git a/cmd/migration/1_5_2.go b/cmd/migration/1_5_2.go
new file mode 100644
index 0000000..303659e
--- /dev/null
+++ b/cmd/migration/1_5_2.go
@@ -0,0 +1,33 @@
+package migration
+
+import (
+	"github.com/alireza0/s-ui/util"
+
+	"gorm.io/gorm"
+)
+
+// to1_5_2 hashes any plaintext admin passwords stored in the users table so a
+// leaked database no longer exposes credentials in the clear.
+func to1_5_2(tx *gorm.DB) error {
+	type userRow struct {
+		Id       uint
+		Password string
+	}
+	var users []userRow
+	if err := tx.Raw("SELECT id, password FROM users").Scan(&users).Error; err != nil {
+		return err
+	}
+	for _, u := range users {
+		if u.Password == "" || util.IsHashedPassword(u.Password) {
+			continue
+		}
+		hashed, err := util.HashPassword(u.Password)
+		if err != nil {
+			return err
+		}
+		if err := tx.Exec("UPDATE users SET password = ? WHERE id = ?", hashed, u.Id).Error; err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/cmd/migration/main.go b/cmd/migration/main.go
index 0b67e17..e057300 100644
--- a/cmd/migration/main.go
+++ b/cmd/migration/main.go
@@ -83,6 +83,14 @@ func MigrateDb() {
 		}
 	}
 
+	if dbVersion < "1.5.2" {
+		err = to1_5_2(tx)
+		if err != nil {
+			log.Fatal("Migration to 1.5.2 failed: ", err)
+			return
+		}
+	}
+
 	// Set version
 	err = tx.Exec("UPDATE settings SET value = ? WHERE key = ?", currentVersion, "version").Error
 	if err != nil {
diff --git a/config/version b/config/version
index 8e03717..a73b432 100644
--- a/config/version
+++ b/config/version
@@ -1 +1 @@
-1.5.1
\ No newline at end of file
+1.5.2
\ No newline at end of file
diff --git a/frontend b/frontend
index d99b082..bc4cda4 160000
--- a/frontend
+++ b/frontend
@@ -1 +1 @@
-Subproject commit d99b082e0f9ee82079cea05dcdce5b7d435c8784
+Subproject commit bc4cda476bfeea2986efef31727afb8c4d4bfb08