diff --git a/routes/userRoutes.js b/routes/userRoutes.js
index 6818de7..b163ccc 100644
--- a/routes/userRoutes.js
+++ b/routes/userRoutes.js
@@ -123,13 +123,25 @@ router.delete("/users/:userId", async (req, res) => {
 router.put("/user/:userId", async (req, res) => {
   try {
     const userId = req.params.userId;
-    const { mobile, password, fullname, pic, province, permissions } = req.body;
+    const { mobile, password, fullname, pic, province, permissions, city } =
+      req.body;
 
-    const updatedUser = await User.findByIdAndUpdate(
-      userId,
-      { mobile, password, fullname, pic, province, permissions },
-      { new: true }, // Set { new: true } to return the updated document
-    );
+    const updateFields = {
+      mobile,
+      fullname,
+      pic,
+      province,
+      permissions,
+      city: city ?? "",
+    };
+
+    if (password && String(password).trim() !== "") {
+      updateFields.password = await bcrypt.hash(password, 10);
+    }
+
+    const updatedUser = await User.findByIdAndUpdate(userId, updateFields, {
+      new: true,
+    });
 
     if (!updatedUser) {
       return res.status(404).json({ message: "User not found" });