diff --git a/ProcessMaker/Http/Controllers/Api/UserController.php b/ProcessMaker/Http/Controllers/Api/UserController.php
index d08e3374db..ea56691df4 100644
--- a/ProcessMaker/Http/Controllers/Api/UserController.php
+++ b/ProcessMaker/Http/Controllers/Api/UserController.php
@@ -35,6 +35,48 @@ class UserController extends Controller
     public $doNotSanitize = [
         'username', // has alpha_dash rule
         'password',
+        'firstname', // validated as plain text by User::rules()
+        'lastname', // validated as plain text by User::rules()
+        'title', // validated as plain text by User::rules()
+    ];
+
+    /**
+     * Fields accepted when a non-administrative user updates their own profile.
+     *
+     * @var array<string>
+     */
+    private const SELF_SERVICE_UPDATE_FIELDS = [
+        'username',
+        'password',
+        'firstname',
+        'lastname',
+        'title',
+        'email',
+        'address',
+        'city',
+        'state',
+        'postal',
+        'country',
+        'phone',
+        'fax',
+        'cell',
+        'timezone',
+        'datetime_format',
+        'status',
+        'avatar',
+        'preferences_2fa',
+        'connected_accounts',
+        'meta',
+        'valpassword',
+    ];
+
+    /**
+     * Metadata fields accepted during a self-service profile update.
+     *
+     * @var array<string>
+     */
+    private const SELF_SERVICE_META_FIELDS = [
+        'disableRecommendations',
     ];
 
     /**
@@ -452,12 +494,22 @@ public function getPinnnedControls(User $user)
      */
     public function update(User $user, Request $request)
     {
-        if (!Auth::user()->can('edit', $user)) {
+        $authenticatedUser = Auth::user();
+        if (!$authenticatedUser->can('edit', $user)) {
             throw new AuthorizationException(__('Not authorized to update this user.'));
         }
 
-        $request->validate(User::rules($user));
         $fields = $request->json()->all();
+        $isSelfServiceUpdate = $this->authorizeSelfServiceUpdate($authenticatedUser, $user, $fields);
+        $rules = User::rules($user);
+        if ($isSelfServiceUpdate) {
+            $rules['meta'] = ['sometimes', 'array'];
+            $rules['meta.disableRecommendations'] = ['sometimes', 'boolean'];
+        }
+        $request->validate($rules);
+        if ($isSelfServiceUpdate) {
+            $fields = $this->normalizeSelfServiceMeta($user, $fields);
+        }
         if (isset($fields['password'])) {
             $fields['password'] = Hash::make($fields['password']);
             $fields['password_changed_at'] = Carbon::now()->toDateTimeString();
@@ -466,6 +518,7 @@ public function update(User $user, Request $request)
             session()->forget('login-error');
         }
         $original = $user->getOriginal();
+        $isLdapUser = $user->meta?->authenticationType === 'ldap';
         $user->fill($fields);
         if (array_key_exists('cell', $fields)) {
             $response = $this->validateCellPhoneNumber($user, $fields['cell']);
@@ -474,28 +527,24 @@ public function update(User $user, Request $request)
             }
         }
         if ($fields['email'] !== $original['email']) {
+            $ssoUser = $isLdapUser;
             if (class_exists(SsoUser::class)) {
                 // Check if the user is an SSO user (including SAML)
-                $ssoUser = SsoUser::where('user_id', $user->id)->exists();
-
-                // Check if the user is an LDAP user
-                if (isset($user->meta?->authenticationType) && $user->meta->authenticationType === 'ldap') {
-                    $ssoUser = true;
-                }
-                if ($ssoUser) {
-                    return response([
-                        'message' => __(
-                            "The email can't be edited. This action is only available for SSO-synced users."
-                        ),
-                        'errors' => [
-                            'email' => [
-                                __(
-                                    "The email can't be edited. This action is only available for SSO-synced users."
-                                ),
-                            ],
+                $ssoUser = $ssoUser || SsoUser::where('user_id', $user->id)->exists();
+            }
+            if ($ssoUser) {
+                return response([
+                    'message' => __(
+                        "The email can't be edited. This action is only available for SSO-synced users."
+                    ),
+                    'errors' => [
+                        'email' => [
+                            __(
+                                "The email can't be edited. This action is only available for SSO-synced users."
+                            ),
                         ],
-                    ], 422);
-                }
+                    ],
+                ], 422);
             }
             if (!isset($fields['valpassword'])) {
                 return response([
@@ -564,6 +613,59 @@ public function update(User $user, Request $request)
         return response([], 204);
     }
 
+    /**
+     * Authorize and constrain self-service profile updates.
+     */
+    private function authorizeSelfServiceUpdate(User $authenticatedUser, User $targetUser, array $fields): bool
+    {
+        $isSelfServiceUpdate = $authenticatedUser->id === $targetUser->id
+            && !$authenticatedUser->is_administrator
+            && !$authenticatedUser->hasPermission('edit-users');
+
+        if (!$isSelfServiceUpdate) {
+            return false;
+        }
+
+        if (!$authenticatedUser->hasPermission('edit-personal-profile')) {
+            throw new AuthorizationException(__('Not authorized to update this user.'));
+        }
+
+        $disallowedFields = array_diff(array_keys($fields), self::SELF_SERVICE_UPDATE_FIELDS);
+        if ($disallowedFields !== []) {
+            throw new AuthorizationException(__('Not authorized to update one or more user fields.'));
+        }
+
+        if (isset($fields['meta']) && is_array($fields['meta'])) {
+            $disallowedMetaFields = array_diff(array_keys($fields['meta']), self::SELF_SERVICE_META_FIELDS);
+            if ($disallowedMetaFields !== []) {
+                throw new AuthorizationException(__('Not authorized to update one or more user fields.'));
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Merge self-service metadata into the persisted server-managed values.
+     */
+    private function normalizeSelfServiceMeta(User $user, array $fields): array
+    {
+        $meta = (array) $user->meta;
+        if (
+            array_key_exists('meta', $fields)
+            && array_key_exists('disableRecommendations', $fields['meta'])
+        ) {
+            if ($fields['meta']['disableRecommendations']) {
+                $meta['disableRecommendations'] = true;
+            } else {
+                unset($meta['disableRecommendations']);
+            }
+        }
+        $fields['meta'] = $meta ?: null;
+
+        return $fields;
+    }
+
     /**
      * Validate the phone number for SMS two-factor authentication.
      *
diff --git a/ProcessMaker/Http/Middleware/ValidateEditUserAndPasswordPermission.php b/ProcessMaker/Http/Middleware/ValidateEditUserAndPasswordPermission.php
index 416abdbb32..b9375fc620 100644
--- a/ProcessMaker/Http/Middleware/ValidateEditUserAndPasswordPermission.php
+++ b/ProcessMaker/Http/Middleware/ValidateEditUserAndPasswordPermission.php
@@ -15,8 +15,11 @@ public function handle(Request $request, Closure $next)
     {
         $user = $request->route('user');
         $fields = $request->json()->all();
-        if (($fields['username'] !== $user->getAttribute('username') || in_array('password', $fields)) &&
-        !Auth::user()->hasPermission('edit-user-and-password') && !Auth::user()->is_administrator) {
+        $usernameChanged = array_key_exists('username', $fields)
+            && $fields['username'] !== $user->getAttribute('username');
+        $passwordChanged = array_key_exists('password', $fields);
+        if (($usernameChanged || $passwordChanged) &&
+            !Auth::user()->hasPermission('edit-user-and-password') && !Auth::user()->is_administrator) {
             throw new AuthorizationException(__('Not authorized to update the username and password.'));
         }
 
diff --git a/ProcessMaker/Models/User.php b/ProcessMaker/Models/User.php
index c13c133659..87a8ed4487 100644
--- a/ProcessMaker/Models/User.php
+++ b/ProcessMaker/Models/User.php
@@ -16,6 +16,7 @@
 use ProcessMaker\Models\EmptyModel;
 use ProcessMaker\Notifications\ResetPassword as ResetPasswordNotification;
 use ProcessMaker\Query\Traits\PMQL;
+use ProcessMaker\Rules\PlainText;
 use ProcessMaker\Rules\StringHasAtLeastOneUpperCaseCharacter;
 use ProcessMaker\Traits\Exportable;
 use ProcessMaker\Traits\HasAuthorization;
@@ -184,9 +185,10 @@ public static function rules(self $existing = null)
         return [
             // The following characters where not included in the regexp: & %  ' " ? /
             'username' /****/ => ['required', 'regex:/^[a-zA-Z0-9.!#$*+=^_`|~\-@]+$/', 'min:2', 'max:255', $unique],
-            'firstname' /***/ => ['required', 'max:50'],
-            'lastname' /****/ => ['required', 'max:50'],
+            'firstname' /***/ => ['required', 'max:50', new PlainText()],
+            'lastname' /****/ => ['required', 'max:50', new PlainText()],
             'email' /*******/ => ['required', 'email'],
+            'title' /*******/ => ['nullable', 'max:255', new PlainText()],
             'birthdate' /***/ => ['nullable', 'date'],
             'phone' /*******/ => ['nullable', 'regex:/^[+\.0-9x\)\(\-\s\/]*$/'],
             'fax' /*********/ => ['nullable', 'regex:/^[+\.0-9x\)\(\-\s\/]*$/'],
diff --git a/ProcessMaker/Rules/PlainText.php b/ProcessMaker/Rules/PlainText.php
new file mode 100644
index 0000000000..f3a5fb76e2
--- /dev/null
+++ b/ProcessMaker/Rules/PlainText.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace ProcessMaker\Rules;
+
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+
+class PlainText implements ValidationRule
+{
+    /**
+     * Validate that the value does not contain HTML markup.
+     *
+     * @param string  $attribute Attribute being validated.
+     * @param mixed   $value     Value being validated.
+     * @param Closure $fail      Validation failure callback.
+     *
+     * @return void
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (!is_string($value) || strip_tags($value) !== $value) {
+            $fail('The :attribute field must contain plain text only.');
+        }
+    }
+}
diff --git a/resources/js/admin/groups/components/UsersInGroupListing.vue b/resources/js/admin/groups/components/UsersInGroupListing.vue
index 66e32471b7..c52d4736ad 100644
--- a/resources/js/admin/groups/components/UsersInGroupListing.vue
+++ b/resources/js/admin/groups/components/UsersInGroupListing.vue
@@ -15,6 +15,9 @@
             >   <template slot="username" slot-scope="props">
                   <span v-uni-id="props.rowData.id.toString()">{{ props.rowData.username }}</span>
                 </template>
+                <template slot="fullname" slot-scope="props">
+                  <span>{{ props.rowData.fullname }}</span>
+                </template>
                 <template slot="actions" slot-scope="props">
                     <div class="actions">
                         <div class="popout">
@@ -44,8 +47,10 @@
 </template>
 
 <script>
-  import datatableMixin from "../../../components/common/mixins/datatable";
+  import escapeHtml from "lodash/escape";
   import { createUniqIdsMixin } from "vue-uniq-ids";
+
+  import datatableMixin from "../../../components/common/mixins/datatable";
   const uniqIdsMixin = createUniqIdsMixin();
 
   export default {
@@ -74,7 +79,7 @@
           },
           {
             title: () => this.$t("Full Name"),
-            name: "fullname",
+            name: "__slot:fullname",
             sortField: "firstname"
           },
           {
@@ -114,7 +119,7 @@
         let that = this;
         ProcessMaker.confirmModal(
           this.$t("Caution!"),
-          this.$t('Are you sure you want to delete {{item}}?', {item: data.fullname}),
+          this.$t('Are you sure you want to delete {{item}}?', {item: escapeHtml(data.fullname)}),
           null,
           function () {
             ProcessMaker.apiClient
diff --git a/resources/js/admin/users/components/DeletedUsersListing.vue b/resources/js/admin/users/components/DeletedUsersListing.vue
index e16c043b0f..b586e04b1d 100644
--- a/resources/js/admin/users/components/DeletedUsersListing.vue
+++ b/resources/js/admin/users/components/DeletedUsersListing.vue
@@ -23,6 +23,9 @@
         <template slot="username" slot-scope="props">
           <span v-uni-id="props.rowData.id.toString()">{{ props.rowData.username }}</span>
         </template>
+        <template slot="fullname" slot-scope="props">
+          <span>{{ props.rowData.fullname }}</span>
+        </template>
         <template slot="avatar" slot-scope="props">
           <avatar-image size="25" :input-data="props.rowData" hide-name="true"></avatar-image>
         </template>
@@ -56,10 +59,12 @@
 
 
 <script>
+import escapeHtml from "lodash/escape";
+import { createUniqIdsMixin } from "vue-uniq-ids";
+
 import datatableMixin from "../../../components/common/mixins/datatable";
 import dataLoadingMixin from "../../../components/common/mixins/apiDataLoading";
 import AvatarImage from "../../../components/AvatarImage";
-import { createUniqIdsMixin } from "vue-uniq-ids";
 const uniqIdsMixin = createUniqIdsMixin();
 Vue.component("avatar-image", AvatarImage);
 
@@ -93,7 +98,7 @@ export default {
         },
         {
           title: () => this.$t("Full Name"),
-          name: "fullname",
+          name: "__slot:fullname",
           sortField: "fullname"
         },
         {
@@ -169,7 +174,7 @@ export default {
 
       ProcessMaker.confirmModal(
         this.$t('Caution!'),
-        this.$t('Are you sure you want to restore the user {{item}}?', {item: data.fullname}),
+        this.$t('Are you sure you want to restore the user {{item}}?', {item: escapeHtml(data.fullname)}),
         "",
         () => {
           ProcessMaker.apiClient.put('users/restore', $body).then(response => {
diff --git a/resources/js/admin/users/components/UsersListing.vue b/resources/js/admin/users/components/UsersListing.vue
index 36d62668c9..43ab8238be 100644
--- a/resources/js/admin/users/components/UsersListing.vue
+++ b/resources/js/admin/users/components/UsersListing.vue
@@ -23,6 +23,9 @@
         <template slot="username" slot-scope="props">
           <span v-uni-id="props.rowData.id.toString()">{{ props.rowData.username }}</span>
         </template>
+        <template slot="fullname" slot-scope="props">
+          <span>{{ props.rowData.fullname }}</span>
+        </template>
         <template slot="avatar" slot-scope="props">
           <avatar-image size="25" :input-data="props.rowData" hide-name="true"></avatar-image>
         </template>
@@ -54,12 +57,14 @@
 
 
 <script>
+import escapeHtml from "lodash/escape";
+import { createUniqIdsMixin } from "vue-uniq-ids";
+
 import datatableMixin from "../../../components/common/mixins/datatable";
 import dataLoadingMixin from "../../../components/common/mixins/apiDataLoading";
 import AvatarImage from "../../../components/AvatarImage";
 import AddToBundle from "../../../components/shared/AddToBundle.vue";
 import EllipsisMenu from "../../../components/shared/EllipsisMenu.vue";
-import { createUniqIdsMixin } from "vue-uniq-ids";
 const uniqIdsMixin = createUniqIdsMixin();
 Vue.component("avatar-image", AvatarImage);
 
@@ -98,7 +103,7 @@ export default {
         },
         {
           title: () => this.$t("Full Name"),
-          name: "fullname",
+          name: "__slot:fullname",
           sortField: "fullname"
         },
         {
@@ -181,7 +186,7 @@ export default {
             this.$t("Caution!"),
             this.$t("Are you sure you want to delete the user") +
               " " +
-              data.fullname +
+              escapeHtml(data.fullname) +
               this.$t("?"),
             "",
             () => {
diff --git a/resources/views/profile/edit.blade.php b/resources/views/profile/edit.blade.php
index d7d24757a2..6154ab5dc5 100644
--- a/resources/views/profile/edit.blade.php
+++ b/resources/views/profile/edit.blade.php
@@ -128,6 +128,29 @@
                 }
             }
         };
+        const SELF_SERVICE_PROFILE_FIELDS = [
+            'username',
+            'password',
+            'firstname',
+            'lastname',
+            'title',
+            'email',
+            'address',
+            'city',
+            'state',
+            'postal',
+            'country',
+            'phone',
+            'fax',
+            'cell',
+            'timezone',
+            'datetime_format',
+            'status',
+            'avatar',
+            'preferences_2fa',
+            'connected_accounts',
+            'valpassword',
+        ];
         let formVueInstance = new Vue({
             el: '#editProfile',
             mixins:addons,
@@ -251,6 +274,21 @@
                 closeModal() {
                   $('#validateModal').modal('hide');
                 },
+                profilePayload() {
+                    const payload = SELF_SERVICE_PROFILE_FIELDS.reduce((payload, field) => {
+                        if (Object.prototype.hasOwnProperty.call(this.formData, field)) {
+                            payload[field] = this.formData[field];
+                        }
+
+                        return payload;
+                    }, {});
+
+                    payload.meta = {
+                        disableRecommendations: Boolean(this.disableRecommendations),
+                    };
+
+                    return payload;
+                },
                 saveProfileChanges() {
                   this.resetErrors();
                     if (@json($enabled2FA) &&  this.global2FAEnabled.length === 0) {
@@ -270,7 +308,7 @@
                     if (this.image === false) {
                         this.formData.avatar = false;
                     }
-                    ProcessMaker.apiClient.put('users/' + this.formData.id, this.formData)
+                    ProcessMaker.apiClient.put('users/' + this.formData.id, this.profilePayload())
                         .then((response) => {
                             // reset the slack configuration error
                             this.slackConfigurationError = false;
diff --git a/tests/Feature/Api/UsersTest.php b/tests/Feature/Api/UsersTest.php
index c1dacd9e18..e2dc46ccb6 100644
--- a/tests/Feature/Api/UsersTest.php
+++ b/tests/Feature/Api/UsersTest.php
@@ -5,6 +5,7 @@
 use Database\Seeders\PermissionSeeder;
 use Faker\Factory as Faker;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Redis;
 use ProcessMaker\Models\Group;
 use ProcessMaker\Models\GroupMember;
@@ -72,6 +73,18 @@ public function getUpdatedData()
         ];
     }
 
+    private function getSelfServiceUpdateData(User $user, array $overrides = []): array
+    {
+        return array_merge([
+            'username' => $user->username,
+            'firstname' => $user->firstname,
+            'lastname' => $user->lastname,
+            'title' => $user->title,
+            'email' => $user->email,
+            'status' => $user->status,
+        ], $overrides);
+    }
+
     protected function withUserSetup()
     {
         $this->user->is_administrator = true;
@@ -823,14 +836,17 @@ public function testUpdateUserNotAdmin()
         // Validate the header status code
         $response->assertStatus(403);
 
-        //  With permission
+        // With both permissions
+        $this->user->giveDirectPermission('edit-personal-profile');
         $this->user->giveDirectPermission('edit-user-and-password');
         $this->user->save();
         $this->user->refresh();
         $this->flushSession();
 
-        $updateData = $this->getUpdatedData();
-        $updateData['email'] = $verify['email'];
+        $updateData = $this->getSelfServiceUpdateData($this->user, [
+            'username' => 'newusername',
+            'firstname' => 'Updated',
+        ]);
 
         // Post saved success
         $response = $this->apiCall('PUT', $url, $updateData);
@@ -845,6 +861,418 @@ public function testUpdateUserNotAdmin()
         $this->assertNotEquals($verify, $verifyNew);
     }
 
+    public function testUserWithoutProfilePermissionCannotUpdateTheirOwnProfile(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->flushSession();
+        $originalFirstname = $this->user->firstname;
+
+        $response = $this->apiCall(
+            'PUT',
+            self::API_TEST_URL . '/' . $this->user->id,
+            $this->getSelfServiceUpdateData($this->user, ['firstname' => 'Unauthorized'])
+        );
+
+        $response->assertStatus(403);
+        $this->assertDatabaseHas('users', [
+            'id' => $this->user->id,
+            'firstname' => $originalFirstname,
+        ]);
+    }
+
+    public function testUserWithProfilePermissionCanUpdateAllowedFields(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+
+        $response = $this->apiCall(
+            'PUT',
+            self::API_TEST_URL . '/' . $this->user->id,
+            $this->getSelfServiceUpdateData($this->user, [
+                'firstname' => 'Éléazar',
+                'lastname' => 'Reséndez',
+                'title' => 'Research & Development',
+            ])
+        );
+
+        $response->assertStatus(204);
+        $this->assertDatabaseHas('users', [
+            'id' => $this->user->id,
+            'firstname' => 'Éléazar',
+            'lastname' => 'Reséndez',
+            'title' => 'Research & Development',
+        ]);
+    }
+
+    public function testSelfServiceUpdateRejectsDisallowedFieldsWithoutPersistingChanges(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $originalFirstname = $this->user->firstname;
+        $disallowedFields = [
+            'manager_id' => User::factory()->create()->id,
+            'delegation_user_id' => User::factory()->create()->id,
+            'schedule' => ['monday' => []],
+            'force_change_password' => true,
+            'is_administrator' => true,
+        ];
+
+        foreach ($disallowedFields as $field => $value) {
+            $response = $this->apiCall(
+                'PUT',
+                self::API_TEST_URL . '/' . $this->user->id,
+                $this->getSelfServiceUpdateData($this->user, [
+                    'firstname' => 'Should Not Persist',
+                    $field => $value,
+                ])
+            );
+
+            $response->assertStatus(403);
+        }
+
+        $this->assertDatabaseHas('users', [
+            'id' => $this->user->id,
+            'firstname' => $originalFirstname,
+            'manager_id' => null,
+            'delegation_user_id' => null,
+            'force_change_password' => false,
+            'is_administrator' => false,
+        ]);
+    }
+
+    public function testSelfServiceUpdateRejectsServerManagedMetadataWithoutPersistingChanges(): void
+    {
+        $this->user = User::factory()->create([
+            'is_administrator' => false,
+            'status' => 'ACTIVE',
+            'meta' => [
+                'authenticationType' => 'ldap',
+                'serverManagedSetting' => 'preserve-me',
+            ],
+        ]);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $originalFirstname = $this->user->firstname;
+        $originalEmail = $this->user->email;
+
+        foreach (['authenticationType', 'serverManagedSetting'] as $metaField) {
+            $response = $this->apiCall(
+                'PUT',
+                self::API_TEST_URL . '/' . $this->user->id,
+                $this->getSelfServiceUpdateData($this->user, [
+                    'firstname' => 'Should Not Persist',
+                    'email' => 'changed@example.com',
+                    'valpassword' => 'oneOnlyPassword',
+                    'meta' => [
+                        $metaField => null,
+                        'disableRecommendations' => true,
+                    ],
+                ])
+            );
+
+            $response->assertStatus(403);
+        }
+
+        $user = $this->user->fresh();
+        $this->assertSame($originalFirstname, $user->firstname);
+        $this->assertSame($originalEmail, $user->email);
+        $this->assertSame('ldap', $user->meta->authenticationType);
+        $this->assertSame('preserve-me', $user->meta->serverManagedSetting);
+        $this->assertFalse(property_exists($user->meta, 'disableRecommendations'));
+    }
+
+    public function testSelfServiceUpdateOnlyChangesDisableRecommendationsMetadata(): void
+    {
+        $this->user = User::factory()->create([
+            'is_administrator' => false,
+            'status' => 'ACTIVE',
+            'meta' => [
+                'authenticationType' => 'ldap',
+                'serverManagedSetting' => 'preserve-me',
+            ],
+        ]);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $url = self::API_TEST_URL . '/' . $this->user->id;
+
+        $response = $this->apiCall(
+            'PUT',
+            $url,
+            $this->getSelfServiceUpdateData($this->user, [
+                'meta' => ['disableRecommendations' => true],
+            ])
+        );
+
+        $response->assertStatus(204);
+        $user = $this->user->fresh();
+        $this->assertTrue($user->meta->disableRecommendations);
+        $this->assertSame('ldap', $user->meta->authenticationType);
+        $this->assertSame('preserve-me', $user->meta->serverManagedSetting);
+
+        $response = $this->apiCall(
+            'PUT',
+            $url,
+            $this->getSelfServiceUpdateData($user, [
+                'meta' => ['disableRecommendations' => false],
+            ])
+        );
+
+        $response->assertStatus(204);
+        $user = $this->user->fresh();
+        $this->assertFalse(property_exists($user->meta, 'disableRecommendations'));
+        $this->assertSame('ldap', $user->meta->authenticationType);
+        $this->assertSame('preserve-me', $user->meta->serverManagedSetting);
+    }
+
+    public function testSelfServiceUpdateWithoutMetaPreservesServerManagedMetadata(): void
+    {
+        $this->user = User::factory()->create([
+            'is_administrator' => false,
+            'status' => 'ACTIVE',
+            'password' => Hash::make('oneOnlyPassword'),
+            'meta' => [
+                'authenticationType' => 'ldap',
+                'serverManagedSetting' => 'preserve-me',
+            ],
+        ]);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $url = self::API_TEST_URL . '/' . $this->user->id;
+        $originalEmail = $this->user->email;
+
+        $response = $this->apiCall(
+            'PUT',
+            $url,
+            $this->getSelfServiceUpdateData($this->user, [
+                'firstname' => 'Updated Without Meta',
+            ])
+        );
+
+        $response->assertStatus(204);
+        $user = $this->user->fresh();
+        $this->assertSame('Updated Without Meta', $user->firstname);
+        $this->assertSame('ldap', $user->meta->authenticationType);
+        $this->assertSame('preserve-me', $user->meta->serverManagedSetting);
+
+        $response = $this->apiCall(
+            'PUT',
+            $url,
+            $this->getSelfServiceUpdateData($user, [
+                'email' => 'changed@example.com',
+                'valpassword' => 'oneOnlyPassword',
+            ])
+        );
+
+        $response->assertStatus(422)->assertJsonValidationErrors('email');
+        $user = $this->user->fresh();
+        $this->assertSame($originalEmail, $user->email);
+        $this->assertSame('ldap', $user->meta->authenticationType);
+        $this->assertSame('preserve-me', $user->meta->serverManagedSetting);
+    }
+
+    public function testSelfServiceUpdateValidatesDisableRecommendationsAsBoolean(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+
+        $response = $this->apiCall(
+            'PUT',
+            self::API_TEST_URL . '/' . $this->user->id,
+            $this->getSelfServiceUpdateData($this->user, [
+                'meta' => ['disableRecommendations' => 'not-a-boolean'],
+            ])
+        );
+
+        $response->assertStatus(422)->assertJsonValidationErrors('meta.disableRecommendations');
+    }
+
+    public function testLdapUserCannotBypassEmailRestrictionWithAllowedMetadata(): void
+    {
+        $this->user = User::factory()->create([
+            'is_administrator' => false,
+            'status' => 'ACTIVE',
+            'password' => Hash::make('oneOnlyPassword'),
+            'meta' => [
+                'authenticationType' => 'ldap',
+                'serverManagedSetting' => 'preserve-me',
+            ],
+        ]);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $originalEmail = $this->user->email;
+
+        $response = $this->apiCall(
+            'PUT',
+            self::API_TEST_URL . '/' . $this->user->id,
+            $this->getSelfServiceUpdateData($this->user, [
+                'email' => 'changed@example.com',
+                'valpassword' => 'oneOnlyPassword',
+                'meta' => ['disableRecommendations' => true],
+            ])
+        );
+
+        $response->assertStatus(422)->assertJsonValidationErrors('email');
+        $user = $this->user->fresh();
+        $this->assertSame($originalEmail, $user->email);
+        $this->assertSame('ldap', $user->meta->authenticationType);
+        $this->assertSame('preserve-me', $user->meta->serverManagedSetting);
+        $this->assertFalse(property_exists($user->meta, 'disableRecommendations'));
+    }
+
+    public function testAdministratorCanUpdateServerManagedMetadata(): void
+    {
+        $targetUser = User::factory()->create([
+            'status' => 'ACTIVE',
+            'meta' => ['authenticationType' => 'ldap'],
+        ]);
+
+        $response = $this->apiCall(
+            'PUT',
+            self::API_TEST_URL . '/' . $targetUser->id,
+            $this->getSelfServiceUpdateData($targetUser, [
+                'meta' => [
+                    'authenticationType' => 'saml',
+                    'serverManagedSetting' => 'updated-by-admin',
+                ],
+            ])
+        );
+
+        $response->assertStatus(204);
+        $targetUser->refresh();
+        $this->assertSame('saml', $targetUser->meta->authenticationType);
+        $this->assertSame('updated-by-admin', $targetUser->meta->serverManagedSetting);
+    }
+
+    public function testUsernameUpdateRequiresCredentialPermission(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $originalUsername = $this->user->username;
+        $payload = $this->getSelfServiceUpdateData($this->user, ['username' => 'four32745-username']);
+
+        $response = $this->apiCall('PUT', self::API_TEST_URL . '/' . $this->user->id, $payload);
+        $response->assertStatus(403);
+        $this->assertDatabaseHas('users', ['id' => $this->user->id, 'username' => $originalUsername]);
+
+        $this->user->giveDirectPermission('edit-user-and-password');
+        $this->user->refresh();
+        $this->flushSession();
+
+        $response = $this->apiCall('PUT', self::API_TEST_URL . '/' . $this->user->id, $payload);
+        $response->assertStatus(204);
+        $this->assertDatabaseHas('users', ['id' => $this->user->id, 'username' => 'four32745-username']);
+    }
+
+    public function testPasswordUpdateRequiresCredentialPermission(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->user->giveDirectPermission('edit-personal-profile');
+        $this->user->refresh();
+        $this->flushSession();
+        $password = $this->makePassword();
+        $originalPassword = $this->user->password;
+        $payload = $this->getSelfServiceUpdateData($this->user, ['password' => $password]);
+
+        $response = $this->apiCall('PUT', self::API_TEST_URL . '/' . $this->user->id, $payload);
+        $response->assertStatus(403);
+        $this->assertSame($originalPassword, $this->user->fresh()->password);
+
+        $this->user->giveDirectPermission('edit-user-and-password');
+        $this->user->refresh();
+        $this->flushSession();
+
+        $response = $this->apiCall('PUT', self::API_TEST_URL . '/' . $this->user->id, $payload);
+        $response->assertStatus(204);
+        $this->assertTrue(Hash::check($password, $this->user->fresh()->password));
+    }
+
+    public function testUserEditorCanUpdateAnotherUserThroughAdministrativeFlow(): void
+    {
+        $this->user = User::factory()->create(['is_administrator' => false, 'status' => 'ACTIVE']);
+        $this->user->giveDirectPermission('edit-users');
+        $this->user->refresh();
+        $this->flushSession();
+        $targetUser = User::factory()->create(['status' => 'ACTIVE']);
+
+        $response = $this->apiCall(
+            'PUT',
+            self::API_TEST_URL . '/' . $targetUser->id,
+            $this->getSelfServiceUpdateData($targetUser, [
+                'firstname' => 'Administrative',
+                'manager_id' => $this->user->id,
+            ])
+        );
+
+        $response->assertStatus(204);
+        $this->assertDatabaseHas('users', [
+            'id' => $targetUser->id,
+            'firstname' => 'Administrative',
+            'manager_id' => $this->user->id,
+        ]);
+    }
+
+    public function testUserProfileMarkupIsRejectedWithoutChangingStoredValues(): void
+    {
+        $user = User::factory()->create([
+            'firstname' => 'Original First',
+            'lastname' => 'Original Last',
+            'title' => 'Original Title',
+            'status' => 'ACTIVE',
+        ]);
+        $payloads = [
+            ['firstname', '<<img>img src=x onerror=alert(document.domain)>'],
+            ['lastname', '<script>alert(document.domain)</script>'],
+            ['title', '<svg onload=alert(document.domain)>'],
+            ['title', '<iframe src=javascript:alert(document.domain)>'],
+            ['title', '<img src=x onerror=alert(document.domain)>'],
+        ];
+
+        foreach ($payloads as [$field, $markup]) {
+            $response = $this->apiCall(
+                'PUT',
+                self::API_TEST_URL . '/' . $user->id,
+                $this->getSelfServiceUpdateData($user, [$field => $markup])
+            );
+
+            $response->assertStatus(422)->assertJsonValidationErrors($field);
+        }
+
+        $this->assertDatabaseHas('users', [
+            'id' => $user->id,
+            'firstname' => 'Original First',
+            'lastname' => 'Original Last',
+            'title' => 'Original Title',
+        ]);
+    }
+
+    public function testUserCreationRejectsProfileMarkup(): void
+    {
+        $response = $this->apiCall('POST', self::API_TEST_URL, [
+            'username' => 'four32745qa',
+            'firstname' => '<<img>img src=x onerror=alert(document.domain)>',
+            'lastname' => 'FOUR-32745 QA',
+            'title' => '<svg onload=alert(document.domain)>',
+            'email' => 'four32745qa@example.invalid',
+            'status' => 'ACTIVE',
+            'password' => $this->makePassword(),
+        ]);
+
+        $response->assertStatus(422)->assertJsonValidationErrors(['firstname', 'title']);
+        $this->assertDatabaseMissing('users', ['username' => 'four32745qa']);
+    }
+
     public function testDisableRecommendations()
     {
         RecommendationUser::factory()->create([
diff --git a/tests/unit/ProcessMaker/Rules/PlainTextTest.php b/tests/unit/ProcessMaker/Rules/PlainTextTest.php
new file mode 100644
index 0000000000..ce414b2609
--- /dev/null
+++ b/tests/unit/ProcessMaker/Rules/PlainTextTest.php
@@ -0,0 +1,46 @@
+<?php
+
+namespace Tests\Unit\ProcessMaker\Rules;
+
+use Illuminate\Support\Facades\Validator;
+use ProcessMaker\Rules\PlainText;
+use Tests\TestCase;
+
+class PlainTextTest extends TestCase
+{
+    public function testItRejectsHtmlMarkup(): void
+    {
+        $payloads = [
+            '<<img>img src=x onerror=alert(document.domain)>',
+            '<script>alert(document.domain)</script>',
+            '<svg onload=alert(document.domain)>',
+            '<iframe src=javascript:alert(document.domain)>',
+            '<img src=x onerror=alert(document.domain)>',
+            '<!-- comment -->',
+            '<?php echo "unsafe"; ?>',
+        ];
+
+        foreach ($payloads as $payload) {
+            $validator = Validator::make(['value' => $payload], ['value' => [new PlainText()]]);
+
+            $this->assertTrue($validator->fails(), $payload);
+        }
+    }
+
+    public function testItAcceptsPlainText(): void
+    {
+        $values = [
+            'Éléazar Reséndez',
+            'Research & Development',
+            'VP < Sales',
+            '&lt;img src=x&gt;',
+            'javascript:alert(document.domain)',
+        ];
+
+        foreach ($values as $value) {
+            $validator = Validator::make(['value' => $value], ['value' => [new PlainText()]]);
+
+            $this->assertFalse($validator->fails(), $value);
+        }
+    }
+}