diff --git a/application/forms/Account/ChangePasswordForm.php b/application/forms/Account/ChangePasswordForm.php
index 06e9dec86..419731843 100644
--- a/application/forms/Account/ChangePasswordForm.php
+++ b/application/forms/Account/ChangePasswordForm.php
@@ -36,7 +36,7 @@ class ChangePasswordForm extends Form
      *
      * @param PasswordPolicyHook|null $passwordPolicyObject
      */
-    public function __construct($passwordPolicyObject = null)
+    public function __construct(?PasswordPolicyHook $passwordPolicyObject = null)
     {
         $this->passwordPolicyObject = $passwordPolicyObject;
         parent::__construct();
@@ -84,7 +84,7 @@ class ChangePasswordForm extends Form
             array(
                 'label'         => $this->translate('New Password'),
                 'required'      => true,
-                'validators' => [new PasswordValidator()]
+                'validators' => [new PasswordValidator($this->passwordPolicyObject)]
             )
         );
         $this->addElement(
diff --git a/application/forms/Config/General/PasswordPolicyConfigForm.php b/application/forms/Config/General/PasswordPolicyConfigForm.php
index 0f04083e8..c9cd03e4d 100644
--- a/application/forms/Config/General/PasswordPolicyConfigForm.php
+++ b/application/forms/Config/General/PasswordPolicyConfigForm.php
@@ -1,4 +1,5 @@
 <?php
+/* Icinga Web 2 | (c) 2025 Icinga GmbH | GPLv2+ */
 
 namespace Icinga\Forms\Config\General;
 
@@ -12,34 +13,14 @@ use Icinga\Web\Form;
  */
 class PasswordPolicyConfigForm extends Form
 {
-    /**
-     * {@inheritdoc}
-     */
     public function init(): void
     {
         $this->setName('form_config_general_password_policy');
     }
 
-    /**
-     * {@inheritdoc}
-     *
-     * @return  $this
-     */
-    public function createElements(array $formData)
+    public function createElements(array $formData): self
     {
-        $this->addElement(
-            'checkbox',
-            'global_password_policy',
-            array(
-                'label'       => $this->translate('Password Policy'),
-                'value'       => true,
-                'description' => $this->translate(
-                    'Enforce strong password requirements for new passwords'
-                ),
-            )
-        );
-
-        $passwordPolicies = [];
+      $passwordPolicies = [];
 
         foreach (Hook::all('passwordpolicy') as $class => $policy) {
             $passwordPolicies[$class] = $policy->getName();
@@ -49,19 +30,16 @@ class PasswordPolicyConfigForm extends Form
         $this->addElement(
             'select',
             'global_password_policy',
-            array(
+            [
                 'description' => $this->translate(
                     'Enforce strong password requirements for new passwords'
                 ),
                 'label'       => $this->translate('Password Policy'),
                 'multiOptions' => array_merge(
-                    ['' => sprintf(
-                        ' - %s - ',
-                        $this->translate('No Password Policy')
-                    )],
+                    ['' => $this->translate('No Password Policy')],
                     $passwordPolicies
                 ),
-            )
+            ]
         );
 
         return $this;
diff --git a/library/Icinga/Application/Hook/PasswordPolicyHook.php b/library/Icinga/Application/Hook/PasswordPolicyHook.php
index 133214bbc..25dbb215e 100644
--- a/library/Icinga/Application/Hook/PasswordPolicyHook.php
+++ b/library/Icinga/Application/Hook/PasswordPolicyHook.php
@@ -1,4 +1,5 @@
 <?php
+/* Icinga Web 2 | (c) 2025 Icinga GmbH | GPLv2+ */
 
 namespace Icinga\Application\Hook;
 
diff --git a/library/Icinga/Application/ProvidedHook/DefaultPasswordPolicy.php b/library/Icinga/Application/ProvidedHook/DefaultPasswordPolicy.php
index 4e65dc07e..7547f3d36 100644
--- a/library/Icinga/Application/ProvidedHook/DefaultPasswordPolicy.php
+++ b/library/Icinga/Application/ProvidedHook/DefaultPasswordPolicy.php
@@ -1,4 +1,5 @@
 <?php
+/* Icinga Web 2 | (c) 2025 Icinga GmbH | GPLv2+ */
 
 namespace Icinga\Application\ProvidedHook;
 
diff --git a/library/Icinga/Authentication/PasswordValidator.php b/library/Icinga/Authentication/PasswordValidator.php
index cc199f1ce..f4cc49a3b 100644
--- a/library/Icinga/Authentication/PasswordValidator.php
+++ b/library/Icinga/Authentication/PasswordValidator.php
@@ -1,17 +1,33 @@
 <?php
+/* Icinga Web 2 | (c) 2025 Icinga GmbH | GPLv2+ */
 
 namespace Icinga\Authentication;
 
-use Icinga\Application\Config;
+use Icinga\Application\Hook\PasswordPolicyHook;
 use Zend_Validate_Abstract;
 
 class PasswordValidator extends Zend_Validate_Abstract
 {
+    /**
+     * @var PasswordPolicyHook|null
+     */
+    private ?PasswordPolicyHook $passwordPolicyObject;
+
+    /**
+     * Constructor
+     *
+     * @param PasswordPolicyHook|null $passwordPolicyObject
+     */
+    public function __construct(?PasswordPolicyHook $passwordPolicyObject = null)
+    {
+        $this->passwordPolicyObject = $passwordPolicyObject;
+    }
+
     /**
      * Checks if password matches with password policy
      * throws a message if not
      *
-     * If no password policy is configured, all passwords are considered valid
+     * If no password policy is set, all passwords are considered valid
      *
      * @param mixed $value The password to validate
      *
@@ -21,17 +37,14 @@ class PasswordValidator extends Zend_Validate_Abstract
     public function isValid($value): bool
     {
         $this->_messages = [];
-        $passwordPolicy = Config::app()
-            ->get('global', 'password_policy');
 
-        if (! isset($passwordPolicy) || ! class_exists($passwordPolicy)) {
+        if ($this->passwordPolicyObject === null) {
             return true;
         }
 
-        $passwordPolicyObject = new $passwordPolicy();
-        $errorMessage = $passwordPolicyObject->validatePassword($value);
+        $errorMessage = $this->passwordPolicyObject->validatePassword($value);
 
-        if ($errorMessage != null) {
+        if ($errorMessage !== null) {
             $this->_messages[] = $errorMessage;
             return false;
         }