diff --git a/Gemfile b/Gemfile
index 334602aad..1dddb482c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -63,7 +63,7 @@ gem 'barnes'
 
 ##--- gems for authentication & authorization ---##
 gem 'devise'
-gem 'devise-secure_password', '~> 2.0'
+gem 'devise-secure_password', '~> 2.0', git: 'https://github.com/chatwoot/devise-secure_password'
 gem 'devise_token_auth'
 # authorization
 gem 'jwt'
diff --git a/Gemfile.lock b/Gemfile.lock
index 8e102838d..45a7b9133 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,3 +1,11 @@
+GIT
+  remote: https://github.com/chatwoot/devise-secure_password
+  revision: de11e8765654b8242d42101ee9c8ffc8126f7975
+  specs:
+    devise-secure_password (2.0.1)
+      devise (>= 4.0.0, < 5.0.0)
+      railties (>= 5.0.0, < 7.0.0)
+
 GEM
   remote: https://rubygems.org/
   specs:
@@ -152,9 +160,6 @@ GEM
       railties (>= 4.1.0)
       responders
       warden (~> 1.2.3)
-    devise-secure_password (2.0.1)
-      devise (>= 4.0.0, < 5.0.0)
-      railties (>= 5.0.0, < 7.0.0)
     devise_token_auth (1.2.0)
       bcrypt (~> 3.0)
       devise (> 3.5.2, < 5)
@@ -612,6 +617,7 @@ GEM
 
 PLATFORMS
   arm64-darwin-20
+  x86_64-darwin-18
   x86_64-darwin-20
   x86_64-darwin-21
   x86_64-linux
@@ -637,7 +643,7 @@ DEPENDENCIES
   database_cleaner
   ddtrace
   devise
-  devise-secure_password (~> 2.0)
+  devise-secure_password (~> 2.0)!
   devise_token_auth
   dotenv-rails
   down (~> 5.0)
diff --git a/spec/controllers/devise/session_controller_spec.rb b/spec/controllers/devise/session_controller_spec.rb
index 957604be3..d856e0ebf 100644
--- a/spec/controllers/devise/session_controller_spec.rb
+++ b/spec/controllers/devise/session_controller_spec.rb
@@ -18,6 +18,7 @@ RSpec.describe 'Session', type: :request do
 
     context 'when it is valid credentials' do
       let!(:user) { create(:user, password: 'Password1!', account: account) }
+      let!(:user_with_new_pwd) { create(:user, password: 'Password1!.><?', account: account) }
 
       it 'returns successful auth response' do
         params = { email: user.email, password: 'Password1!' }
@@ -29,6 +30,17 @@ RSpec.describe 'Session', type: :request do
         expect(response).to have_http_status(:success)
         expect(response.body).to include(user.email)
       end
+
+      it 'returns successful auth response with new password special characters' do
+        params = { email: user_with_new_pwd.email, password: 'Password1!.><?' }
+
+        post new_user_session_url,
+             params: params,
+             as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.body).to include(user_with_new_pwd.email)
+      end
     end
 
     context 'when it is invalid sso auth token' do