diff --git a/EssentialCSharp.Web/package-lock.json b/EssentialCSharp.Web/package-lock.json
index b4350fcb..fa20dbb0 100644
--- a/EssentialCSharp.Web/package-lock.json
+++ b/EssentialCSharp.Web/package-lock.json
@@ -7,7 +7,7 @@
       "name": "essentialcsharp-web-frontend",
       "dependencies": {
         "@mdi/font": "7.4.47",
-        "@zxcvbn-ts/core": "^3.0.4",
+        "@zxcvbn-ts/core": "^4.1.2",
         "@zxcvbn-ts/language-common": "^4.1.3",
         "@zxcvbn-ts/language-en": "^4.1.1",
         "dompurify": "3.4.13",
@@ -477,9 +477,10 @@
       "license": "MIT"
     },
     "node_modules/@zxcvbn-ts/core": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@zxcvbn-ts/core/-/core-3.0.4.tgz",
-      "integrity": "sha512-aQeiT0F09FuJaAqNrxynlAwZ2mW/1MdXakKWNmGM1Qp/VaY6CnB/GfnMS2T8gB2231Esp1/maCWd8vTG4OuShw==",
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/@zxcvbn-ts/core/-/core-4.1.2.tgz",
+      "integrity": "sha512-RQmxWB3AMI+HGQErQdUv6Aq32aQhp6xOxrfgCP0+T9MsLZoP3xtLHuT8O8VojsUxdmQVZfJlYkYb1A0wOwIS+Q==",
+      "license": "MIT",
       "dependencies": {
         "fastest-levenshtein": "1.0.16"
       }
diff --git a/EssentialCSharp.Web/package.json b/EssentialCSharp.Web/package.json
index 41d2cce0..5f3c4a96 100644
--- a/EssentialCSharp.Web/package.json
+++ b/EssentialCSharp.Web/package.json
@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@mdi/font": "7.4.47",
-    "@zxcvbn-ts/core": "^3.0.4",
+    "@zxcvbn-ts/core": "^4.1.2",
     "@zxcvbn-ts/language-common": "^4.1.3",
     "@zxcvbn-ts/language-en": "^4.1.1",
     "dompurify": "3.4.13",
diff --git a/EssentialCSharp.Web/wwwroot/js/password-strength.js b/EssentialCSharp.Web/wwwroot/js/password-strength.js
index 4a578271..15181915 100644
--- a/EssentialCSharp.Web/wwwroot/js/password-strength.js
+++ b/EssentialCSharp.Web/wwwroot/js/password-strength.js
@@ -9,7 +9,7 @@
  *   data-min-length            — Minimum password length enforced server-side (from PasswordRequirementOptions)
  */
 
-import { zxcvbn, zxcvbnOptions } from '@zxcvbn-ts/core';
+import { ZxcvbnFactory } from '@zxcvbn-ts/core';
 
 const SCORE_CONFIG = [
     { label: 'Very weak', barClass: 'bg-danger',            width: 20 },
@@ -21,6 +21,7 @@ const SCORE_CONFIG = [
 
 let zxcvbnReady = false;
 let zxcvbnLoadPromise = null;
+let zxcvbn = null;
 
 async function ensureZxcvbn() {
     if (zxcvbnReady) return;
@@ -32,7 +33,7 @@ async function ensureZxcvbn() {
     }
     try {
         const [zxcvbnCommon, zxcvbnEn] = await zxcvbnLoadPromise;
-        zxcvbnOptions.setOptions({
+        zxcvbn = new ZxcvbnFactory({
             translations: zxcvbnEn.translations,
             graphs: zxcvbnCommon.adjacencyGraphs,
             dictionary: { ...zxcvbnCommon.dictionary, ...zxcvbnEn.dictionary },
@@ -281,7 +282,7 @@ function initMeter(container) {
         // Guard against stale result if the user kept typing during the initial load
         if (password !== passwordInput.value) return;
         const userInputs = getUserInputValues(userInputFieldIds);
-        const result = zxcvbn(password, userInputs);
+        const result = zxcvbn.check(password, userInputs);
 
         // Render zxcvbn result immediately; HIBP check runs asynchronously below.
         if (hibpWarningActive) {