diff --git a/pkg/api/admin_users.go b/pkg/api/admin_users.go
index 674963631d8..91a706def3b 100644
--- a/pkg/api/admin_users.go
+++ b/pkg/api/admin_users.go
@@ -121,12 +121,12 @@ func (hs *HTTPServer) AdminUpdateUserPassword(c *models.ReqContext) response.Res
 		return response.Error(500, "Could not encode password", err)
 	}
 
-	cmd := models.ChangeUserPasswordCommand{
-		UserId:      userID,
+	cmd := user.ChangeUserPasswordCommand{
+		UserID:      userID,
 		NewPassword: passwordHashed,
 	}
 
-	if err := hs.SQLStore.ChangeUserPassword(c.Req.Context(), &cmd); err != nil {
+	if err := hs.userService.ChangePassword(c.Req.Context(), &cmd); err != nil {
 		return response.Error(500, "Failed to update user password", err)
 	}
 
diff --git a/pkg/api/password.go b/pkg/api/password.go
index 8fe86839f0e..8f5590b89eb 100644
--- a/pkg/api/password.go
+++ b/pkg/api/password.go
@@ -71,15 +71,15 @@ func (hs *HTTPServer) ResetPassword(c *models.ReqContext) response.Response {
 		return response.Error(400, "New password is too short", nil)
 	}
 
-	cmd := models.ChangeUserPasswordCommand{}
-	cmd.UserId = query.Result.ID
+	cmd := user.ChangeUserPasswordCommand{}
+	cmd.UserID = query.Result.ID
 	var err error
 	cmd.NewPassword, err = util.EncodePassword(form.NewPassword, query.Result.Salt)
 	if err != nil {
 		return response.Error(500, "Failed to encode password", err)
 	}
 
-	if err := hs.SQLStore.ChangeUserPassword(c.Req.Context(), &cmd); err != nil {
+	if err := hs.userService.ChangePassword(c.Req.Context(), &cmd); err != nil {
 		return response.Error(500, "Failed to change user password", err)
 	}
 
diff --git a/pkg/api/user.go b/pkg/api/user.go
index bb471997438..cda48841343 100644
--- a/pkg/api/user.go
+++ b/pkg/api/user.go
@@ -379,7 +379,7 @@ func (hs *HTTPServer) ChangeActiveOrgAndRedirectToHome(c *models.ReqContext) {
 // 403: forbiddenError
 // 500: internalServerError
 func (hs *HTTPServer) ChangeUserPassword(c *models.ReqContext) response.Response {
-	cmd := models.ChangeUserPasswordCommand{}
+	cmd := user.ChangeUserPasswordCommand{}
 	if err := web.Bind(c.Req, &cmd); err != nil {
 		return response.Error(http.StatusBadRequest, "bad request data", err)
 	}
@@ -407,13 +407,13 @@ func (hs *HTTPServer) ChangeUserPassword(c *models.ReqContext) response.Response
 		return response.Error(400, "New password is too short", nil)
 	}
 
-	cmd.UserId = c.UserId
+	cmd.UserID = c.UserId
 	cmd.NewPassword, err = util.EncodePassword(cmd.NewPassword, user.Salt)
 	if err != nil {
 		return response.Error(500, "Failed to encode password", err)
 	}
 
-	if err := hs.SQLStore.ChangeUserPassword(c.Req.Context(), &cmd); err != nil {
+	if err := hs.userService.ChangePassword(c.Req.Context(), &cmd); err != nil {
 		return response.Error(500, "Failed to change user password", err)
 	}
 
diff --git a/pkg/cmd/grafana-cli/commands/reset_password_command.go b/pkg/cmd/grafana-cli/commands/reset_password_command.go
index 73b1844282c..583a6934c87 100644
--- a/pkg/cmd/grafana-cli/commands/reset_password_command.go
+++ b/pkg/cmd/grafana-cli/commands/reset_password_command.go
@@ -52,12 +52,12 @@ func resetPasswordCommand(c utils.CommandLine, runner runner.Runner) error {
 		return err
 	}
 
-	cmd := models.ChangeUserPasswordCommand{
-		UserId:      AdminUserId,
+	cmd := user.ChangeUserPasswordCommand{
+		UserID:      AdminUserId,
 		NewPassword: passwordHashed,
 	}
 
-	if err := runner.SQLStore.ChangeUserPassword(context.Background(), &cmd); err != nil {
+	if err := runner.UserService.ChangePassword(context.Background(), &cmd); err != nil {
 		return fmt.Errorf("failed to update user password: %w", err)
 	}
 
diff --git a/pkg/services/sqlstore/mockstore/mockstore.go b/pkg/services/sqlstore/mockstore/mockstore.go
index f83aceee998..5954cf9b3f2 100644
--- a/pkg/services/sqlstore/mockstore/mockstore.go
+++ b/pkg/services/sqlstore/mockstore/mockstore.go
@@ -137,10 +137,6 @@ func (m *SQLStoreMock) CreateUser(ctx context.Context, cmd user.CreateUserComman
 	return nil, m.ExpectedError
 }
 
-func (m *SQLStoreMock) ChangeUserPassword(ctx context.Context, cmd *models.ChangeUserPasswordCommand) error {
-	return m.ExpectedError
-}
-
 func (m *SQLStoreMock) UpdateUserLastSeenAt(ctx context.Context, cmd *models.UpdateUserLastSeenAtCommand) error {
 	return m.ExpectedError
 }
diff --git a/pkg/services/sqlstore/store.go b/pkg/services/sqlstore/store.go
index 5119b28ded8..4710285646f 100644
--- a/pkg/services/sqlstore/store.go
+++ b/pkg/services/sqlstore/store.go
@@ -31,7 +31,6 @@ type Store interface {
 	GetUserLoginAttemptCount(ctx context.Context, query *models.GetUserLoginAttemptCountQuery) error
 	DeleteOldLoginAttempts(ctx context.Context, cmd *models.DeleteOldLoginAttemptsCommand) error
 	CreateUser(ctx context.Context, cmd user.CreateUserCommand) (*user.User, error)
-	ChangeUserPassword(ctx context.Context, cmd *models.ChangeUserPasswordCommand) error
 	UpdateUserLastSeenAt(ctx context.Context, cmd *models.UpdateUserLastSeenAtCommand) error
 	SetUsingOrg(ctx context.Context, cmd *models.SetUsingOrgCommand) error
 	GetUserProfile(ctx context.Context, query *models.GetUserProfileQuery) error
diff --git a/pkg/services/user/model.go b/pkg/services/user/model.go
index 2f3d05a7f16..4aa4f9cdbb3 100644
--- a/pkg/services/user/model.go
+++ b/pkg/services/user/model.go
@@ -75,6 +75,13 @@ type UpdateUserCommand struct {
 	UserID int64 `json:"-"`
 }
 
+type ChangeUserPasswordCommand struct {
+	OldPassword string `json:"oldPassword"`
+	NewPassword string `json:"newPassword"`
+
+	UserID int64 `json:"-"`
+}
+
 func (u *User) NameOrFallback() string {
 	if u.Name != "" {
 		return u.Name
diff --git a/pkg/services/user/user.go b/pkg/services/user/user.go
index f6d3e9e6268..a2478db0ad8 100644
--- a/pkg/services/user/user.go
+++ b/pkg/services/user/user.go
@@ -11,4 +11,5 @@ type Service interface {
 	GetByLogin(context.Context, *GetUserByLoginQuery) (*User, error)
 	GetByEmail(context.Context, *GetUserByEmailQuery) (*User, error)
 	Update(context.Context, *UpdateUserCommand) error
+	ChangePassword(context.Context, *ChangeUserPasswordCommand) error
 }
diff --git a/pkg/services/user/userimpl/user.go b/pkg/services/user/userimpl/user.go
index 599401d13cb..74632a54583 100644
--- a/pkg/services/user/userimpl/user.go
+++ b/pkg/services/user/userimpl/user.go
@@ -279,3 +279,13 @@ func (s *Service) Update(ctx context.Context, cmd *user.UpdateUserCommand) error
 	}
 	return s.sqlStore.UpdateUser(ctx, q)
 }
+
+//  TODO: remove wrapper around sqlstore
+func (s *Service) ChangePassword(ctx context.Context, cmd *user.ChangeUserPasswordCommand) error {
+	q := &models.ChangeUserPasswordCommand{
+		UserId:      cmd.UserID,
+		NewPassword: cmd.NewPassword,
+		OldPassword: cmd.OldPassword,
+	}
+	return s.sqlStore.ChangeUserPassword(ctx, q)
+}
diff --git a/pkg/services/user/usertest/fake.go b/pkg/services/user/usertest/fake.go
index 205c7c605f3..6480f77a496 100644
--- a/pkg/services/user/usertest/fake.go
+++ b/pkg/services/user/usertest/fake.go
@@ -38,3 +38,7 @@ func (f *FakeUserService) GetByEmail(ctx context.Context, query *user.GetUserByE
 func (f *FakeUserService) Update(ctx context.Context, cmd *user.UpdateUserCommand) error {
 	return f.ExpectedError
 }
+
+func (f *FakeUserService) ChangePassword(ctx context.Context, cmd *user.ChangeUserPasswordCommand) error {
+	return f.ExpectedError
+}