diff --git a/services/graph/pkg/service/v0/driveitems.go b/services/graph/pkg/service/v0/driveitems.go
index 83406696f5..4f9432c558 100644
--- a/services/graph/pkg/service/v0/driveitems.go
+++ b/services/graph/pkg/service/v0/driveitems.go
@@ -654,11 +654,18 @@ func (g Graph) UpdatePermission(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// We don't implement updating link permissions yet
+	// This is a public link
 	if _, ok := oldPermission.GetLinkOk(); ok {
-		errorcode.NotSupported.Render(w, r, http.StatusNotImplemented, "not implemented")
+		updatedPermission, err := g.updatePublicLinkPermission(ctx, permissionID, &itemID, permission)
+		if err != nil {
+			errorcode.RenderError(w, r, err)
+			return
+		}
+		render.Status(r, http.StatusOK)
+		render.JSON(w, r, &updatedPermission)
 		return
 	}
+
 	// This is a user share
 	updatedPermission, err := g.updateUserShare(ctx, permissionID, oldPermission, permission)
 	if err != nil {
diff --git a/services/graph/pkg/service/v0/links.go b/services/graph/pkg/service/v0/links.go
index 737b081aab..d450975ab3 100644
--- a/services/graph/pkg/service/v0/links.go
+++ b/services/graph/pkg/service/v0/links.go
@@ -248,7 +248,30 @@ func (g Graph) updatePublicLinkPassword(ctx context.Context, permissionID string
 	return permission, nil
 }
 
-func (g Graph) updatePublicLinkPermission(ctx context.Context, permissionID string, info *providerv1beta1.ResourceInfo, newPermission *libregraph.Permission) (perm *libregraph.Permission, err error) {
+func (g Graph) updatePublicLinkPermission(ctx context.Context, permissionID string, itemID *providerv1beta1.ResourceId, newPermission *libregraph.Permission) (perm *libregraph.Permission, err error) {
+	gatewayClient, err := g.gatewaySelector.Next()
+	if err != nil {
+		g.logger.Error().Err(err).Msg("could not select next gateway client")
+		return nil, errorcode.New(errorcode.GeneralException, err.Error())
+	}
+
+	statResp, err := gatewayClient.Stat(
+		ctx,
+		&providerv1beta1.StatRequest{
+			Ref: &providerv1beta1.Reference{
+				ResourceId: itemID,
+				Path:       ".",
+			},
+		})
+	if err != nil {
+		g.logger.Error().Err(err).Msg("transport error, could not stat resource")
+		return nil, errorcode.New(errorcode.GeneralException, err.Error())
+	}
+	if code := statResp.GetStatus().GetCode(); code != rpc.Code_CODE_OK {
+		g.logger.Debug().Interface("itemID", itemID).Msg(statResp.GetStatus().GetMessage())
+		return nil, errorcode.New(cs3StatusToErrCode(code), statResp.GetStatus().GetMessage())
+	}
+
 	if newPermission.HasExpirationDateTime() {
 		expirationDate := newPermission.GetExpirationDateTime()
 		update := &link.UpdatePublicShareRequest_Update{
@@ -279,7 +302,7 @@ func (g Graph) updatePublicLinkPermission(ctx context.Context, permissionID stri
 			libregraph.DriveItemCreateLink{
 				Type: &changedLink,
 			},
-			info.GetType(),
+			statResp.GetInfo().GetType(),
 		)
 		update := &link.UpdatePublicShareRequest_Update{
 			Type: link.UpdatePublicShareRequest_Update_TYPE_PERMISSIONS,
diff --git a/services/graph/pkg/validate/libregraph.go b/services/graph/pkg/validate/libregraph.go
index 3cd523d078..ebfec9724a 100644
--- a/services/graph/pkg/validate/libregraph.go
+++ b/services/graph/pkg/validate/libregraph.go
@@ -47,6 +47,10 @@ func permission(v *validator.Validate) {
 			sl.ReportError(permission.Id, "Id", "Id", "readonly", "")
 		}
 
+		if _, ok := permission.GetHasPasswordOk(); ok {
+			sl.ReportError(permission.HasPassword, "hasPassword", "HasPassword", "readonly", "")
+		}
+
 		rolesAndActions(sl, permission.Roles, permission.LibreGraphPermissionsActions, true)
 	}, s)
 }