@@ -182,7 +182,7 @@ The Printer Settings Modal (Media & Feed / Print Quality / Clock & Time / Encodi
 | `[ ]` | `~PS` | print start | `Coming soon` |
 | `[ ]` | `~JS` | change backfeed sequence | `Coming soon` |
 | `[ ]` | `^JW` | set ribbon tension | `Coming soon` |
-| `[ ]` | `^JU` | configuration update | `Coming soon` |
+| `[x]` | `^JU` | configuration update | |
 
 ## Clock & time
 
@@ -207,7 +207,7 @@ The Printer Settings Modal (Media & Feed / Print Quality / Clock & Time / Encodi
 |:-:|---|---|---|
 | `[x]` | `^KN` | printer name + description | |
 | `[x]` | `^SL` | clock mode (S / T / TOL) + language | |
-| `[ ]` | `^KP` | set password | `Coming soon` |
+| `[x]` | `^KP` | set password | |
 
 ## Configuration & persistence
 
 
@@ -1,28 +1,59 @@
-import { useId } from "react";
+import { useId, useState } from "react";
 import { useT } from "../../lib/useT";
 import { useLabelStore } from "../../store/labelStore";
 import { inputCls, labelCls } from "../ui/formStyles";
-import { PRINTER_NAME_MAX_LEN } from "../../types/PrinterProfile";
+import {
+  CONFIG_UPDATE_VALUES,
+  type ConfigUpdateAction,
+  PRINTER_NAME_MAX_LEN,
+  PRINTER_PASSWORD_REGEX,
+  isConfigUpdateAction,
+} from "../../types/PrinterProfile";
 import {
   ZplCommandLabel,
+  ZplEnumSelect,
   ZplField,
   ZplSubField,
 } from "./zplFieldPrimitives";
 
-/** Tab 5 of the Printer Settings Modal — printer identity setup.
- *  Emits ^KN (printer name + description) on the Setup-Script
- *  channel; both fields fold into a single `^KNname,description`
- *  command at emit time. The tab stays intentionally focused on
- *  "what is this printer called" — ^SL (clock-formatting Mode +
- *  Language) lives in Tab 3 Clock & Time per its semantic home.
- *  See memory:project_ticket_sl_clock_formatting for the ^SL
- *  follow-up. */
+type LocIdentity = ReturnType<typeof useT>["printerSettings"]["identity"];
+
+/** Explicit value → locale-key map; `satisfies` forces every
+ *  ConfigUpdateAction to have an entry and rejects typo keys at
+ *  compile time. Matches the CLOCK_FORMAT_LABEL_KEYS pattern. */
+const CONFIG_UPDATE_LABEL_KEYS = {
+  S: 'configurationUpdateOptionS',
+  R: 'configurationUpdateOptionR',
+  N: 'configurationUpdateOptionN',
+  F: 'configurationUpdateOptionF',
+} as const satisfies Record<ConfigUpdateAction, keyof LocIdentity>;
+
+/** Tab 5 of the Printer Settings Modal: printer identity + EEPROM
+ *  commit setup. Emits ^KN (name + description), ^KP (4-digit panel
+ *  password) and ^JU (configuration update action) on the Setup-
+ *  Script channel. ^SL lives in Tab 3 Clock & Time per its semantic
+ *  home. See memory:project_ticket_sl_clock_formatting. */
 export function IdentityTab() {
   const t = useT();
   const profile = useLabelStore((s) => s.printerProfile);
   const patchPrinterProfile = useLabelStore((s) => s.patchPrinterProfile);
   const loc = t.printerSettings.identity;
   const nameId = useId();
+  const passwordId = useId();
+  // Local mirror for the 4-digit input: progressive typing ("4", "47")
+  // is shown immediately but only commits to the store once the regex
+  // matches. Without this, partial values would always be filtered out
+  // and the user could never finish entering a password. Re-sync on
+  // store changes (import, reset) uses the adjust-state-during-render
+  // pattern so the React compiler doesn't flag a useEffect → setState
+  // cascade.
+  const storedPassword = profile.setPassword ?? "";
+  const [passwordDraft, setPasswordDraft] = useState(storedPassword);
+  const [lastStoredPassword, setLastStoredPassword] = useState(storedPassword);
+  if (lastStoredPassword !== storedPassword) {
+    setLastStoredPassword(storedPassword);
+    setPasswordDraft(storedPassword);
+  }
 
   return (
     <div className="flex flex-col gap-4">
@@ -61,6 +92,43 @@ export function IdentityTab() {
           )}
         </ZplSubField>
       </ZplField>
+
+      <ZplField>
+        <ZplCommandLabel text={loc.setPassword} command="^KP" htmlFor={passwordId} />
+        <input
+          id={passwordId}
+          type="text"
+          inputMode="numeric"
+          pattern="\d{4}"
+          maxLength={4}
+          className={inputCls}
+          value={passwordDraft}
+          onChange={(e) => {
+            const raw = e.target.value;
+            if (!/^\d{0,4}$/.test(raw)) return;
+            setPasswordDraft(raw);
+            if (raw === "") {
+              patchPrinterProfile({ setPassword: undefined });
+            } else if (PRINTER_PASSWORD_REGEX.test(raw)) {
+              patchPrinterProfile({ setPassword: raw });
+            }
+          }}
+        />
+        <span className={`${labelCls} normal-case tracking-normal text-muted/70`}>
+          {loc.setPasswordHint}
+        </span>
+      </ZplField>
+
+      <ZplEnumSelect
+        label={loc.configurationUpdate}
+        command="^JU"
+        values={CONFIG_UPDATE_VALUES}
+        isValid={isConfigUpdateAction}
+        value={profile.configurationUpdate}
+        onChange={(configurationUpdate) => patchPrinterProfile({ configurationUpdate })}
+        defaultLabel={loc.configurationUpdateUnset}
+        optionLabel={(v) => loc[CONFIG_UPDATE_LABEL_KEYS[v]]}
+      />
     </div>
   );
 }
@@ -1,12 +1,12 @@
 import type { PrinterProfile } from "../../../types/PrinterProfile";
-import { CLOCK_TOLERANCE_RANGE, HEAD_TEST_INTERVAL_RANGE, PRINTER_NAME_MAX_LEN, TEAR_OFF_ADJUST_RANGE, isClockFormat, isClockLanguage, isPrinterLocale, isZplMode, setupScriptUnsafeCharRegex } from "../../../types/PrinterProfile";
+import { CLOCK_TOLERANCE_RANGE, HEAD_TEST_INTERVAL_RANGE, PRINTER_NAME_MAX_LEN, PRINTER_PASSWORD_REGEX, TEAR_OFF_ADJUST_RANGE, isClockFormat, isClockLanguage, isConfigUpdateAction, isPrinterLocale, isZplMode, setupScriptUnsafeCharRegex } from "../../../types/PrinterProfile";
 import { parseIntOrUndef } from "../../inputParse";
 import { parseRealtimeClock } from "../../realtimeClock";
 import { inRange, strParam } from "../helpers";
 import type { Handler } from "../types";
 
 /** Setup-Script commands (^JZ, ^JT, ~TA, ^ST, ^KD, ^KL, ^SE, ^SZ,
- *  ^KN, ^SL) — all write the shared `printerProfile` slice. */
+ *  ^KN, ^SL, ^KP, ^JU): all write the shared `printerProfile` slice. */
 export function createSetupScriptHandlers(
   printerProfile: Partial<PrinterProfile>,
 ): Record<string, Handler> {
@@ -73,5 +73,13 @@ export function createSetupScriptHandlers(
       const b = strParam(p[1]);
       if (isClockLanguage(b)) printerProfile.clockLanguage = b;
     },
+    KP(p) {
+      const raw = (p[0] ?? "").trim();
+      if (PRINTER_PASSWORD_REGEX.test(raw)) printerProfile.setPassword = raw;
+    },
+    JU(_, rest) {
+      const v = rest.trim().toUpperCase();
+      if (isConfigUpdateAction(v)) printerProfile.configurationUpdate = v;
+    },
   };
 }
@@ -22,7 +22,6 @@ export function createUnsupportedHandlers(
     JI: noop,
     JR: noop,
     JS: noop,
-    JU: noop,
     PP: noop,
     // Browser-limit factories — surface as "not loaded" findings.
     FL: mkBrowserLimit("FL"),
 
@@ -238,6 +238,66 @@ describe("generateSetupScript — output shape", () => {
     expect(() => printerProfileSchema.parse({ ...base, printerName: "abcdefghij0123456" })).toThrow();
   });
 
+  it("emits ^KP for a 4-digit password", () => {
+    expect(generateSetupScript({ ...base, setPassword: "4711" }))
+      .toBe("^XA\n^KP4711\n^XZ");
+  });
+
+  it("preserves ^KP0000 (the disable-protection value)", () => {
+    expect(generateSetupScript({ ...base, setPassword: "0000" }))
+      .toBe("^XA\n^KP0000\n^XZ");
+  });
+
+  it("schema rejects non-4-digit passwords", () => {
+    expect(() => printerProfileSchema.parse({ ...base, setPassword: "123" })).toThrow();
+    expect(() => printerProfileSchema.parse({ ...base, setPassword: "12345" })).toThrow();
+    expect(() => printerProfileSchema.parse({ ...base, setPassword: "abcd" })).toThrow();
+  });
+
+  it("round-trips ^KP via the parser", () => {
+    const { printerProfile: parsed } = parseZPL("^XA^KP9876^XZ");
+    expect(parsed.setPassword).toBe("9876");
+  });
+
+  it("parser rejects ^KP values that don't match the 4-digit shape", () => {
+    expect(parseZPL("^XA^KP12^XZ").printerProfile.setPassword).toBeUndefined();
+    expect(parseZPL("^XA^KP12A4^XZ").printerProfile.setPassword).toBeUndefined();
+  });
+
+  it("emits ^JU{action} for each spec value", () => {
+    expect(generateSetupScript({ ...base, configurationUpdate: "S" }))
+      .toBe("^XA\n^JUS\n^XZ");
+    expect(generateSetupScript({ ...base, configurationUpdate: "R" }))
+      .toBe("^XA\n^JUR\n^XZ");
+    expect(generateSetupScript({ ...base, configurationUpdate: "N" }))
+      .toBe("^XA\n^JUN\n^XZ");
+    expect(generateSetupScript({ ...base, configurationUpdate: "F" }))
+      .toBe("^XA\n^JUF\n^XZ");
+  });
+
+  it("places ^JU last in the block so ^JUS commits everything before it", () => {
+    const script = generateSetupScript({
+      ...base,
+      setPassword: "4711",
+      printerName: "lab-01",
+      configurationUpdate: "S",
+    });
+    const lines = script.split("\n");
+    expect(lines[lines.length - 2]).toBe("^JUS");
+    expect(lines[lines.length - 1]).toBe("^XZ");
+  });
+
+  it("round-trips ^JU via the parser", () => {
+    for (const action of ["S", "R", "N", "F"] as const) {
+      const { printerProfile: parsed } = parseZPL(`^XA^JU${action}^XZ`);
+      expect(parsed.configurationUpdate).toBe(action);
+    }
+  });
+
+  it("parser rejects ^JU with an unknown action letter", () => {
+    expect(parseZPL("^XA^JUX^XZ").printerProfile.configurationUpdate).toBeUndefined();
+  });
+
   it("emits ^SL with mode S only when language is unset", () => {
     expect(generateSetupScript({ ...base, clockMode: "S" })).toBe("^XA\n^SLS\n^XZ");
   });
@@ -346,12 +406,24 @@ describe("generateSetupScript — output shape", () => {
       "zplMode",
       "printerName",
       "printerDescription",
+      "setPassword",
       "clockMode",
       "clockTolerance",
       "clockLanguage",
+      "configurationUpdate",
     ]);
   });
 
+  it("places configurationUpdate as the last entry so ^JUS commits the block", () => {
+    // Tripwire: ^JU emits whatever persistent writes precede it, so a
+    // future field added after configurationUpdate would land inside
+    // the same ^XA…^XZ block and only get committed on the next
+    // print job, not at provisioning.
+    expect(SETUP_SCRIPT_FIELDS[SETUP_SCRIPT_FIELDS.length - 1]).toBe(
+      "configurationUpdate",
+    );
+  });
+
   it("PrinterProfile carries only Setup-Script fields — no per-label leakage", () => {
     // The schema must not accept per-label keys (^MD, ~SD, ^PR, ^MN
     // and friends). This pins the "no double-source-of-truth"
 
@@ -98,6 +98,11 @@ const SETUP_SCRIPT_EMITTERS = {
     },
   },
   printerDescription: { kind: 'foldedInto', target: 'printerName' },
+  setPassword: {
+    kind: 'emit',
+    channel: 'block',
+    emit: (p) => p.setPassword !== undefined ? `^KP${p.setPassword}` : null,
+  },
   clockMode: {
     kind: 'emit',
     channel: 'block',
@@ -115,6 +120,19 @@ const SETUP_SCRIPT_EMITTERS = {
   // Drop bare `^SL,<lang>` (mode unset): spec leaves the shape
   // implementation-defined.
   clockLanguage: { kind: 'foldedInto', target: 'clockMode' },
+  // configurationUpdate is the registry's last entry on purpose: a
+  // commit (`^JUS`) needs to follow every other persistent write so
+  // the EEPROM lands the rest of the block before being asked to
+  // save itself. The Zebra app note for ^JU also warns that more
+  // than one ^JU per file is unsupported, so we never split this.
+  // The "is-last" invariant is anchored by a tripwire in
+  // zplSetupScript.test.ts so adding a later entry can't silently
+  // break the commit semantics.
+  configurationUpdate: {
+    kind: 'emit',
+    channel: 'block',
+    emit: (p) => p.configurationUpdate !== undefined ? `^JU${p.configurationUpdate}` : null,
+  },
 } as const satisfies Partial<Record<keyof PrinterProfile, SetupScriptEntry>>;
 
 /** Public list of the PrinterProfile fields that flow through the
 
@@ -235,6 +235,14 @@ const ar = {
       printerName: 'اسم الطابعة',
       printerNameHint: 'Max 16 characters. Used in front-panel labels and ZebraNet print server.',
       printerDescription: 'وصف الطابعة',
+      setPassword: 'كلمة مرور اللوحة الأمامية',
+      setPasswordHint: '4 أرقام. 0000 يعطل قفل وضع إعداد LCD. الإعداد الافتراضي: 1234.',
+      configurationUpdate: 'تحديث الإعدادات',
+      configurationUpdateUnset: '(بدون إجراء)',
+      configurationUpdateOptionS: 'S — حفظ في EEPROM',
+      configurationUpdateOptionR: 'R — استدعاء آخر إعداد محفوظ',
+      configurationUpdateOptionN: 'N — إعادة تحميل إعدادات الشبكة المصنعية (مدمر)',
+      configurationUpdateOptionF: 'F — إعادة الضبط للمصنع (مدمر)',
     },
   },
 
 
@@ -235,6 +235,14 @@ const bg = {
       printerName: 'Име на принтера',
       printerNameHint: 'Макс. 16 знака. Използва се в етикетите на предния панел и сървъра за печат ZebraNet.',
       printerDescription: 'Описание на принтера',
+      setPassword: 'Парола на панела',
+      setPasswordHint: '4 цифри. 0000 деактивира заключването на LCD. Фабрична настройка: 1234.',
+      configurationUpdate: 'Актуализация на конфигурацията',
+      configurationUpdateUnset: '(без действие)',
+      configurationUpdateOptionS: 'S — Запис в EEPROM',
+      configurationUpdateOptionR: 'R — Извикване на последно записаното',
+      configurationUpdateOptionN: 'N — Зареди фабрични мрежови настройки (разрушително)',
+      configurationUpdateOptionF: 'F — Фабрично нулиране (разрушително)',
     },
   },
 
 
@@ -235,6 +235,14 @@ const cs = {
       printerName: 'Název tiskárny',
       printerNameHint: 'Max. 16 znaků. Používá se v štítcích předního panelu a tiskovém serveru ZebraNet.',
       printerDescription: 'Popis tiskárny',
+      setPassword: 'Heslo panelu',
+      setPasswordHint: '4 číslice. 0000 vypne uzamčení LCD. Tovární výchozí: 1234.',
+      configurationUpdate: 'Aktualizace konfigurace',
+      configurationUpdateUnset: '(žádná akce)',
+      configurationUpdateOptionS: 'S — Uložit do EEPROM',
+      configurationUpdateOptionR: 'R — Obnovit poslední uloženou',
+      configurationUpdateOptionN: 'N — Načíst tovární síťová nastavení (destruktivní)',
+      configurationUpdateOptionF: 'F — Tovární reset (destruktivní)',
     },
   },
 
 
@@ -235,6 +235,14 @@ const da = {
       printerName: 'Printernavn',
       printerNameHint: 'Maks. 16 tegn. Bruges i frontpanel-etiketter og ZebraNet-printserver.',
       printerDescription: 'Printerbeskrivelse',
+      setPassword: 'Frontpanelens adgangskode',
+      setPasswordHint: '4 cifre. 0000 deaktiverer LCD-låsen. Fabriksstandard: 1234.',
+      configurationUpdate: 'Konfigurationsopdatering',
+      configurationUpdateUnset: '(ingen handling)',
+      configurationUpdateOptionS: 'S — Gem i EEPROM',
+      configurationUpdateOptionR: 'R — Hent senest gemte',
+      configurationUpdateOptionN: 'N — Indlæs fabrik-netværksindstillinger (destruktiv)',
+      configurationUpdateOptionF: 'F — Fabriksnulstilling (destruktiv)',
     },
   },