diff --git a/.gitignore b/.gitignore
index 428217a..476b6ff 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,6 @@
 # .tfstate files
 *.tfstate
 *.tfstate.*
+
+# Lockfiles
+.terraform.lock.hcl
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bba068..b157a8e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## v0.1.3 (2024-01-08)
+
+### Fixed
+
+*   Allow user to change password without MFA configured.
+
 ## v0.1.2 (2019-08-09)
 
 *   Resolves inability to assume roles across accounts.
diff --git a/groups/main.tf b/groups/main.tf
index e8e1631..093c831 100644
--- a/groups/main.tf
+++ b/groups/main.tf
@@ -254,11 +254,13 @@ data "aws_iam_policy_document" "self_management" {
       "iam:DeleteVirtualMFADevice",
       "iam:EnableMFADevice",
       "iam:GetAccountPasswordPolicy",
+      "iam:GetLoginProfile",
       "iam:GetUser",
       "iam:ListMFADevices",
       "iam:ListUsers",
       "iam:ListVirtualMFADevices",
       "iam:ResyncMFADevice",
+      "iam:UpdateLoginProfile",
       "sts:GetSessionToken",
     ]