From 0f8c28aee40f4ee1df62785ee6d61c5ebf023923 Mon Sep 17 00:00:00 2001
From: Matt <276692477+mattxtaz2@users.noreply.github.com>
Date: Thu, 16 Apr 2026 19:15:44 +0100
Subject: [PATCH 1/3] Add opts.Username, opts.Hostname to AddKey in the "key
 passwd" command so that --user and --host flags work

---
 cmd/restic/cmd_key_passwd.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cmd/restic/cmd_key_passwd.go b/cmd/restic/cmd_key_passwd.go
index fad1361da..c45ac96ed 100644
--- a/cmd/restic/cmd_key_passwd.go
+++ b/cmd/restic/cmd_key_passwd.go
@@ -71,7 +71,7 @@ func changePassword(ctx context.Context, repo *repository.Repository, gopts glob
 		return err
 	}
 
-	id, err := repository.AddKey(ctx, repo, pw, "", "", repo.Key())
+	id, err := repository.AddKey(ctx, repo, pw, opts.Username, opts.Hostname, repo.Key())
 	if err != nil {
 		return errors.Fatalf("creating new key failed: %v", err)
 	}

From f8afd4ed04fc0ff9736129f940336955362e0f4e Mon Sep 17 00:00:00 2001
From: Michael Eischer <michael.eischer@fau.de>
Date: Sun, 10 May 2026 22:08:24 +0200
Subject: [PATCH 2/3] key passwd: test that user and host flags are handled

---
 cmd/restic/cmd_key_integration_test.go | 32 ++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/cmd/restic/cmd_key_integration_test.go b/cmd/restic/cmd_key_integration_test.go
index 000094632..abc5d96c7 100644
--- a/cmd/restic/cmd_key_integration_test.go
+++ b/cmd/restic/cmd_key_integration_test.go
@@ -86,6 +86,36 @@ func testRunKeyPasswd(t testing.TB, newPassword string, gopts global.Options) {
 	rtest.OK(t, err)
 }
 
+func testRunKeyPasswdUserHost(t testing.TB, newPassword string, gopts global.Options) {
+	testKeyNewPassword = newPassword
+	defer func() {
+		testKeyNewPassword = ""
+	}()
+
+	t.Log("changing password and setting key for john@example.com")
+	err := withTermStatus(t, gopts, func(ctx context.Context, gopts global.Options) error {
+		return runKeyPasswd(ctx, gopts, KeyPasswdOptions{
+			KeyAddOptions: KeyAddOptions{
+				Username: "john",
+				Hostname: "example.com",
+			},
+		}, []string{}, gopts.Term)
+	})
+	rtest.OK(t, err)
+
+	gopts.Password = testKeyNewPassword
+	_ = withTermStatus(t, gopts, func(ctx context.Context, gopts global.Options) error {
+		repo, err := global.OpenRepository(ctx, gopts, &progress.NoopPrinter{})
+		rtest.OK(t, err)
+		key, err := repository.SearchKey(ctx, repo, testKeyNewPassword, 1, "")
+		rtest.OK(t, err)
+
+		rtest.Equals(t, "john", key.Username)
+		rtest.Equals(t, "example.com", key.Hostname)
+		return nil
+	})
+}
+
 func testRunKeyRemove(t testing.TB, gopts global.Options, IDs []string) {
 	t.Logf("remove %d keys: %q\n", len(IDs), IDs)
 	for _, id := range IDs {
@@ -111,6 +141,8 @@ func TestKeyAddRemove(t *testing.T) {
 
 	testRunKeyPasswd(t, "geheim2", env.gopts)
 	env.gopts.Password = "geheim2"
+	testRunKeyPasswdUserHost(t, "geheim3", env.gopts)
+	env.gopts.Password = "geheim3"
 	t.Logf("changed password to %q", env.gopts.Password)
 
 	for _, newPassword := range passwordList {

From 1cdb0a9c96acb5c6d486437ad507c8c7b72c6005 Mon Sep 17 00:00:00 2001
From: Michael Eischer <michael.eischer@fau.de>
Date: Sun, 10 May 2026 22:08:40 +0200
Subject: [PATCH 3/3] add changelog for key passwd fix

---
 changelog/unreleased/issue-5757 | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 changelog/unreleased/issue-5757

diff --git a/changelog/unreleased/issue-5757 b/changelog/unreleased/issue-5757
new file mode 100644
index 000000000..33e34fafe
--- /dev/null
+++ b/changelog/unreleased/issue-5757
@@ -0,0 +1,8 @@
+Bugfix: respect `--user` and `--host` in `key passwd`
+
+The `key passwd` command silently ignored the `--user` and `--host` flags
+and always recorded the new key with the current user and host name.
+This has been fixed,
+
+https://github.com/restic/restic/issues/5757
+https://github.com/restic/restic/pull/21781
\ No newline at end of file