diff --git a/src/BusProNet/ApiClient.php b/src/BusProNet/ApiClient.php
index c485046..93a27b2 100644
--- a/src/BusProNet/ApiClient.php
+++ b/src/BusProNet/ApiClient.php
@@ -44,7 +44,7 @@ class ApiClient
                 'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
                 'art' => 'Adressdaten',
                 'email' => $email,
-                'passwort' => md5($password),
+                'passwort' => $password,
             ],
         ];
 
@@ -67,7 +67,7 @@ class ApiClient
                 'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
                 'art' => 'Adressdaten_Ändern',
                 'email' => $user->getEmail(),
-                'passwort' => md5($password),
+                'passwort' => $password,
                 'idadresse' => $user->getBusProAddressId(),
                 'adressdaten' => $teamer->toPayload(),
             ],
@@ -106,7 +106,7 @@ class ApiClient
                 'satz' => ['@typ' => static::TYPE_CUSTOMER_DATA],
                 'art' => 'SelektionCRM',
                 'email' => $email,
-                'passwort' => md5($password),
+                'passwort' => $password,
             ],
         ];
 
diff --git a/src/Security/BpnAuthenticator.php b/src/Security/BpnAuthenticator.php
index 35a47b0..61f2988 100644
--- a/src/Security/BpnAuthenticator.php
+++ b/src/Security/BpnAuthenticator.php
@@ -46,7 +46,11 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
     public function authenticate(Request $request): Passport
     {
         $email = trim($request->request->get('_username', ''));
-        $password = trim($request->request->get('_password', ''));
+        $passwordPlain = trim($request->request->get('_password', ''));
+
+        // Very lame hashing applied here as required by BPN
+        $password = md5($passwordPlain);
+
         $csrfToken = $request->request->get('_csrf_token', '');
 
         return new SelfValidatingPassport(