diff --git a/C4/Auth.pm b/C4/Auth.pm
index d4b83bb75e..75b699456e 100644
--- a/C4/Auth.pm
+++ b/C4/Auth.pm
@@ -1457,6 +1457,8 @@ sub checkauth {
         too_many_login_attempts               => ( $patron and $patron->account_locked ),
         password_has_expired                  => ( $patron and $patron->password_expired ),
         is_anonymous_patron                   => ( $is_anonymous_patron ),
+        password_expiration_date              => ( $patron and $patron->password_expiration_date ),
+        date_enrolled                         => ( $patron and $patron->dateenrolled ),
         auth_error                            => $auth_error,
     );
 
diff --git a/Koha/Patron.pm b/Koha/Patron.pm
index d95e5fc4ab..af1484de47 100644
--- a/Koha/Patron.pm
+++ b/Koha/Patron.pm
@@ -291,11 +291,16 @@ sub store {
                 # Make a copy of the plain text password for later use
                 $self->plain_text_password( $self->password );
 
-                $self->password_expiration_date(
-                      $self->password
-                    ? $self->category->get_password_expiry_date || undef
-                    : undef
-                );
+                if($self->category->effective_force_password_reset_when_set_by_staff and ($self->categorycode ne C4::Context->preference("PatronSelfRegistrationDefaultCategory"))){
+                    $self->password_expiration_date(dt_from_string);
+                }
+                else {
+                    $self->password_expiration_date(
+                          $self->password
+                        ? $self->category->get_password_expiry_date || undef
+                        : undef
+                    );
+                }
 
                 # Create a disabled account if no password provided
                 $self->password(
diff --git a/Koha/Patron/Category.pm b/Koha/Patron/Category.pm
index 70ebc00705..179397cb05 100644
--- a/Koha/Patron/Category.pm
+++ b/Koha/Patron/Category.pm
@@ -229,6 +229,22 @@ sub effective_require_strong_password {
     return $self->require_strong_password // C4::Context->preference('RequireStrongPassword');
 }
 
+=head3 effective_force_password_reset_when_set_by_staff
+
+    $category->effective_force_password_reset_when_set_by_staff()
+
+Returns if new staff created patrons in this category are forced to reset their password. If set in $self->force_password_reset_when_set_by_staff
+or, if undef, falls back to the ForcePasswordResetWhenSetByStaff system preference.
+
+=cut
+
+sub effective_force_password_reset_when_set_by_staff {
+    my ($self) = @_;
+
+    return $self->force_password_reset_when_set_by_staff // C4::Context->preference('ForcePasswordResetWhenSetByStaff');
+}
+
+
 =head3 override_hidden_items
 
     if ( $patron->category->override_hidden_items ) {
diff --git a/admin/categories.pl b/admin/categories.pl
index 8fdaaf9d76..60d14a76b0 100755
--- a/admin/categories.pl
+++ b/admin/categories.pl
@@ -84,11 +84,13 @@ elsif ( $op eq 'cud-add_validate' ) {
 
     my @branches = grep { $_ ne q{} } $input->multi_param('branches');
     my $can_be_guarantee = $input->param('can_be_guarantee');
+    my $force_password_reset_when_set_by_staff = $input->param('force_password_reset_when_set_by_staff');
 
     $reset_password = undef if $reset_password eq -1;
     $change_password = undef if $change_password eq -1;
     $min_password_length = undef unless length($min_password_length);
     $require_strong_password = undef if $require_strong_password eq -1;
+    $force_password_reset_when_set_by_staff = undef if $force_password_reset_when_set_by_staff eq -1;
 
     my $is_a_modif = $input->param("is_a_modif");
 
@@ -119,6 +121,7 @@ elsif ( $op eq 'cud-add_validate' ) {
         $category->noissuescharge($noissuescharge);
         $category->noissueschargeguarantees($noissueschargeguarantees);
         $category->noissueschargeguarantorswithguarantees($noissueschargeguarantorswithguarantees);
+        $category->force_password_reset_when_set_by_staff($force_password_reset_when_set_by_staff);
         eval {
             $category->store;
             $category->replace_library_limits( \@branches );
@@ -157,6 +160,7 @@ elsif ( $op eq 'cud-add_validate' ) {
                 noissuescharge                         => $noissuescharge,
                 noissueschargeguarantees               => $noissueschargeguarantees,
                 noissueschargeguarantorswithguarantees => $noissueschargeguarantorswithguarantees,
+                force_password_reset_when_set_by_staff => $force_password_reset_when_set_by_staff,
             }
         );
         eval {
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
index 16d8c87542..440da9eade 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/categories.tt
@@ -341,6 +341,41 @@
                       [% END %]
                     </select>
                 </li>
+                <li>
+                    <label for="force_password_reset_when_set_by_staff">Force new patron password reset: </label>
+                    <select name="force_password_reset_when_set_by_staff" id="force_password_reset_when_set_by_staff">
+                        [% IF category.force_password_reset_when_set_by_staff.defined %]
+                            [% IF category.force_password_reset_when_set_by_staff %]
+                                [% IF Koha.Preference('ForcePasswordResetWhenSetByStaff') %]
+                                    <option value="-1">Follow system preference ForcePasswordResetWhenSetByStaff (Force)</option>
+                                [% ELSE %]
+                                    <option value="-1">Follow system preference ForcePasswordResetWhenSetByStaff (Don't force)</option>
+                                [% END %]
+                                    <option value="1" selected="selected">Force</option>
+                                    <option value="0">Don't force</option>
+                            [% ELSE %]
+                                [% IF Koha.Preference('ForcePasswordResetWhenSetByStaff') %]
+                                    <option value="-1">Follow system preference ForcePasswordResetWhenSetByStaff (Force)</option>
+                                [% ELSE %]
+                                    <option value="-1">Follow system preference ForcePasswordResetWhenSetByStaff (Don't force)</option>
+                                [% END %]
+                                    <option value="1">Force</option>
+                                    <option value="0" selected="selected">Don't force</option>
+                            [% END %]
+                        [% ELSE %]
+                            [% IF Koha.Preference('ForcePasswordResetWhenSetByStaff') %]
+                                <option value="-1" selected="selected">Follow system preference ForcePasswordResetWhenSetByStaff (Force)</option>
+                            [% ELSE %]
+                                <option value="-1" selected="selected">Follow system preference ForcePasswordResetWhenSetByStaff (Don't force)</option>
+                            [% END %]
+                                <option value="1">Force</option>
+                                <option value="0">Don't force</option>
+                        [% END %]
+                    </select>
+                    <div class="hint">
+                        Choose whether staff created patrons of this category be forced into resetting their password after their first OPAC login.
+                    </div>
+                </li>
                 <li><label for="block_expired">Block expired patron OPAC actions:</label>
                     <select name="BlockExpiredPatronOpacActions" id="block_expired" multiple="multiple">
                         <optgroup label="Follow system preference">
diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref
index f593a80612..3a9c6ec118 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/admin/preferences/patrons.pref
@@ -1,4 +1,4 @@
-fPatrons:
+Patrons:
     General:
      -
          - pref: CheckPrevCheckout
diff --git a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
index 632dab59cd..bd87cc3cb0 100644
--- a/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
+++ b/koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-auth.tt
@@ -202,9 +202,15 @@
                         [% END %]
 
                         [% IF !(invalid_username_or_password || too_many_login_attempts) and password_has_expired %]
-                            <div class="alert alert-info">
-                                <p><strong>Error: </strong>Your password has expired!</p>
-                            </div>
+                            [% IF date_enrolled == password_expiration_date %]
+                                <div class="alert alert-info">
+                                    <p><strong>Error: </strong>It's your first login! You need to reset your password.</p>
+                                </div>
+                            [% ELSE %]
+                                <div class="alert alert-info">
+                                    <p><strong>Error: </strong>Your password has expired!</p>
+                                </div>
+                            [% END %]
                             [% IF Koha.Preference('EnableExpiredPasswordReset') %]
                                 <a href="/cgi-bin/koha/opac-reset-password.pl">Reset your password</a>.
                             [% ELSIF Koha.Preference('OpacPasswordChange') && Categories.can_any_reset_password %]