diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index be9978293c225f7313c9efe74254fb448d6f955e..ac7ef0f97729a68de7792dea2d21e5255772cbb6 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -820,6 +820,9 @@
         </intent>
 
         <provider android:authorities="foundation.e.mail.provider.AppContentProvider" />
+
+        <!-- Murena Password app -->
+        <package android:name="foundation.e.passwords"/>
     </queries>
 
 </manifest>
diff --git a/app/src/main/kotlin/at/bitfire/davdroid/App.kt b/app/src/main/kotlin/at/bitfire/davdroid/App.kt
index 1f9f8ac9b48fb091e43e81dd722361f26d1f1767..40dc013cea0bc6e63fdab19e8c7223325f825c95 100644
--- a/app/src/main/kotlin/at/bitfire/davdroid/App.kt
+++ b/app/src/main/kotlin/at/bitfire/davdroid/App.kt
@@ -9,6 +9,7 @@ import android.content.Context
 import android.net.Uri
 import android.os.StrictMode
 import androidx.appcompat.content.res.AppCompatResources
+import androidx.core.content.edit
 import androidx.core.graphics.drawable.toBitmap
 import androidx.hilt.work.HiltWorkerFactory
 import androidx.work.Configuration
@@ -57,6 +58,8 @@ class App: Application(), Thread.UncaughtExceptionHandler, Configuration.Provide
                 .build()
         }
 
+        private const val UPGRADE_PREFS = "upgrade_prefs"
+        private const val PASSWORD_SYNC_ENABLED_ON_UPGRADE = "password_sync_enabled_on_upgrade"
     }
 
     @Inject lateinit var accountsUpdatedListener: AccountsUpdatedListener
@@ -113,6 +116,20 @@ class App: Application(), Thread.UncaughtExceptionHandler, Configuration.Provide
             TasksWatcher.watch(this)
             // check whether a tasks app is currently installed
             SyncUtils.updateTaskSync(this)
+
+            // We shipped Password app as disabled in v3.7. Adding an account while it is disabled
+            // leaves its sync toggle off, so retry enabling it on startup until it succeeds.
+            val upgradePreferences = applicationContext.getSharedPreferences(
+                UPGRADE_PREFS,
+                MODE_PRIVATE
+            )
+            if (!upgradePreferences.getBoolean(PASSWORD_SYNC_ENABLED_ON_UPGRADE, false)) {
+                val enabled = SyncUtils.enablePasswordAppSync(this)
+                upgradePreferences.edit {
+                    putBoolean(PASSWORD_SYNC_ENABLED_ON_UPGRADE, enabled)
+                }
+                Logger.log.log(Level.INFO, "sync for password app enabled : $enabled")
+            }
         }
     }
 
diff --git a/app/src/main/kotlin/at/bitfire/davdroid/syncadapter/SyncUtils.kt b/app/src/main/kotlin/at/bitfire/davdroid/syncadapter/SyncUtils.kt
index dc16a7db7c2ac1df0987f9c02e7cf8bd7a66a48c..535fff051f86763f6d1d0cfc9d6b21aec0b85e75 100644
--- a/app/src/main/kotlin/at/bitfire/davdroid/syncadapter/SyncUtils.kt
+++ b/app/src/main/kotlin/at/bitfire/davdroid/syncadapter/SyncUtils.kt
@@ -115,6 +115,18 @@ object SyncUtils {
         return result
     }
 
+    fun enablePasswordAppSync(context: Context): Boolean {
+        val eeloAccountType = context.getString(R.string.eelo_account_type)
+        val account = AccountManager.get(context)
+            .getAccountsByType(eeloAccountType)
+            .firstOrNull() ?: return false
+
+        val authority = context.getString(R.string.password_authority)
+        ContentResolver.setIsSyncable(account, authority, 1)
+        ContentResolver.setSyncAutomatically(account, authority, true)
+        return ContentResolver.getSyncAutomatically(account, authority)
+    }
+
     // task sync utils
 
     @WorkerThread