diff --git a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java
index be573db6d43e..5621cfe49d84 100644
--- a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java
+++ b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/DefaultUserService.java
@@ -613,6 +613,10 @@ public int getActiveUsersCount(Date since) {
   @Override
   @Transactional(readOnly = true)
   public boolean userNonExpired(User user) {
+    if (user == null) {
+      return true;
+    }
+
     int credentialsExpires = systemSettingManager.credentialsExpires();
 
     if (credentialsExpires == 0) {
diff --git a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/PasswordHistoryValidationRule.java b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/PasswordHistoryValidationRule.java
index b0786bb0a89f..6798f501088d 100644
--- a/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/PasswordHistoryValidationRule.java
+++ b/dhis-2/dhis-services/dhis-service-core/src/main/java/org/hisp/dhis/user/PasswordHistoryValidationRule.java
@@ -78,7 +78,7 @@ public PasswordValidationResult validate(CredentialsInfo credentials) {
   private boolean isRuleApplicable(CredentialsInfo credentials) {
     User user = userService.getUserByUsername(credentials.getUsername());
 
-    if (!userService.userNonExpired(user)) {
+    if (user != null && !userService.userNonExpired(user)) {
       return true;
     }
 
diff --git a/dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/user/PasswordValidationRuleTest.java b/dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/user/PasswordValidationRuleTest.java
index f9bf7b8415ac..d149dd85b925 100644
--- a/dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/user/PasswordValidationRuleTest.java
+++ b/dhis-2/dhis-services/dhis-service-core/src/test/java/org/hisp/dhis/user/PasswordValidationRuleTest.java
@@ -38,6 +38,7 @@
 import org.hisp.dhis.setting.SystemSettingManager;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
@@ -273,4 +274,16 @@ void testPasswordHistoryValidationRule() {
     Assertions.assertEquals(23, userArgumentCaptor.getValue().getPreviousPasswords().size());
     assertFalse(userArgumentCaptor.getValue().getPreviousPasswords().contains(STRONG_PASSWORD));
   }
+
+  @Test
+  @DisplayName("PasswordHistoryValidationRule with new user and credentials expires")
+  void testPasswordHistoryValidationRuleWithNewUserAndCredentialsExpires() {
+    // The user does not exist yet, so getUserByUsername returns null
+    CredentialsInfo credentialsInfo = new CredentialsInfo(USERNAME, STRONG_PASSWORD, EMAIL, true);
+
+    // This should not throw NullPointerException
+    PasswordValidationResult result = historyValidationRule.validate(credentialsInfo);
+
+    assertThat(result.isValid(), is(true));
+  }
 }