diff --git a/mmv1/products/alloydb/User.yaml b/mmv1/products/alloydb/User.yaml
index bdee4dccc6ae..c9b8ff40044a 100644
--- a/mmv1/products/alloydb/User.yaml
+++ b/mmv1/products/alloydb/User.yaml
@@ -22,8 +22,8 @@ docs:
 base_url: '{{cluster}}/users'
 self_link: '{{cluster}}/users/{{user_id}}'
 create_url: '{{cluster}}/users?userId={{user_id}}'
-update_url: '{{cluster}}/users?userId={{user_id}}'
-update_verb: 'POST'
+update_verb: 'PATCH'
+update_mask: true
 import_format:
   - 'projects/{{project}}/locations/{{location}}/clusters/{{cluster}}/users/{{user_id}}'
 timeouts:
@@ -33,6 +33,7 @@ timeouts:
 autogen_async: true
 custom_code:
   custom_import: 'templates/terraform/custom_import/alloydb_user.go.tmpl'
+  pre_update: 'templates/terraform/pre_update/alloydb_user.go.tmpl'
 # Skipping the sweeper because instances will be deleted during cluster sweeps
 exclude_sweeper: true
 examples:
diff --git a/mmv1/templates/terraform/pre_update/alloydb_user.go.tmpl b/mmv1/templates/terraform/pre_update/alloydb_user.go.tmpl
new file mode 100644
index 000000000000..903b717834d2
--- /dev/null
+++ b/mmv1/templates/terraform/pre_update/alloydb_user.go.tmpl
@@ -0,0 +1,17 @@
+// If password_wo_version changed, the user wants to update the password.
+// Write-only fields aren't in state, so d.HasChange("password_wo") is always
+// false and the value is never added to obj by the generated code. Handle
+// both the update mask and the request body here.
+if d.HasChange("password_wo_version") {
+	if pw := tpgresource.GetRawConfigAttributeAsString(d, "password_wo"); pw != "" {
+		obj["password"] = pw
+	}
+	updateMask = append(updateMask, "password")
+
+	// Rebuild the updateMask query parameter.
+	url = strings.Split(url, "?updateMask=")[0]
+	url, err = transport_tpg.AddQueryParams(url, map[string]string{"updateMask": strings.Join(updateMask, ",")})
+	if err != nil {
+		return err
+	}
+}