diff --git a/packages/plugins/acl/src/__tests__/users.test.ts b/packages/plugins/acl/src/__tests__/users.test.ts
new file mode 100644
index 0000000000..da2a16495e
--- /dev/null
+++ b/packages/plugins/acl/src/__tests__/users.test.ts
@@ -0,0 +1,52 @@
+import Database from '@nocobase/database';
+import { MockServer } from '@nocobase/test';
+import { prepareApp } from './prepare';
+
+describe('actions', () => {
+  let app: MockServer;
+  let db: Database;
+  let adminUser;
+  let agent;
+  let adminAgent;
+  let pluginUser;
+
+  beforeEach(async () => {
+    process.env.INIT_ROOT_EMAIL = 'test@nocobase.com';
+    process.env.INIT_ROOT_PASSWORD = '123456';
+    process.env.INIT_ROOT_NICKNAME = 'Test';
+
+    app = await prepareApp();
+    db = app.db;
+
+    pluginUser = app.getPlugin('@nocobase/plugin-users');
+    adminUser = await db.getRepository('users').findOne({
+      filter: {
+        email: process.env.INIT_ROOT_EMAIL
+      },
+      appends: ['roles']
+    });
+
+    agent = app.agent();
+    adminAgent = app.agent().auth(
+      pluginUser.jwtService.sign({
+        userId: adminUser.get('id'),
+      }),
+      { type: 'bearer' },
+    );
+  });
+
+  afterEach(async () => {
+    await db.close();
+  });
+
+  it('update profile with roles', async () => {
+    const res2 = await adminAgent.resource('users').updateProfile({
+      filterByTk: adminUser.id,
+      values: {
+        nickname: 'a',
+        roles: adminUser.roles
+      }
+    });
+    expect(res2.status).toBe(200);
+  });
+});
diff --git a/packages/plugins/users/src/__tests__/actions.test.ts b/packages/plugins/users/src/__tests__/actions.test.ts
index 41431c3ecc..a9e96ed097 100644
--- a/packages/plugins/users/src/__tests__/actions.test.ts
+++ b/packages/plugins/users/src/__tests__/actions.test.ts
@@ -1,30 +1,41 @@
 import Database from '@nocobase/database';
-import PluginACL from '@nocobase/plugin-acl';
 import { mockServer, MockServer } from '@nocobase/test';
-import supertest from 'supertest';
 import PluginUsers from '../server';
 import { userPluginConfig } from './utils';
 
 describe('actions', () => {
-  let api: MockServer;
+  let app: MockServer;
   let db: Database;
+  let adminUser;
   let agent;
+  let adminAgent;
   let pluginUser;
 
   beforeEach(async () => {
-    api = mockServer();
-    await api.cleanDb();
+    app = mockServer();
+    await app.cleanDb();
     process.env.INIT_ROOT_EMAIL = 'test@nocobase.com';
     process.env.INIT_ROOT_PASSWORD = '123456';
     process.env.INIT_ROOT_NICKNAME = 'Test';
-    api.plugin(PluginUsers, userPluginConfig);
-    api.plugin(PluginACL);
+    app.plugin(PluginUsers, userPluginConfig);
 
-    await api.loadAndInstall();
-    db = api.db;
+    await app.loadAndInstall();
+    db = app.db;
 
-    agent = supertest.agent(api.callback());
-    pluginUser = api.getPlugin('@nocobase/plugin-users');
+    pluginUser = app.getPlugin('@nocobase/plugin-users');
+    adminUser = await db.getRepository('users').findOne({
+      filter: {
+        email: process.env.INIT_ROOT_EMAIL
+      }
+    });
+
+    agent = app.agent();
+    adminAgent = app.agent().auth(
+      pluginUser.jwtService.sign({
+        userId: adminUser.get('id'),
+      }),
+      { type: 'bearer' },
+    );
   });
 
   afterEach(async () => {
@@ -34,7 +45,7 @@ describe('actions', () => {
   it('should login user with password', async () => {
     const { INIT_ROOT_EMAIL, INIT_ROOT_PASSWORD } = process.env;
 
-    let response = await api.agent().resource('users').check();
+    let response = await agent.resource('users').check();
     expect(response.body.data.id).toBeUndefined();
 
     response = await agent.post('/users:signin').send({
@@ -51,4 +62,22 @@ describe('actions', () => {
     response = await agent.get('/users:check').set({ Authorization: 'Bearer ' + token });
     expect(response.body.data.id).toBeDefined();
   });
+
+  it('update profile', async () => {
+    const res1 = await agent.resource('users').updateProfile({
+      filterByTk: adminUser.id,
+      values: {
+        nickname: 'a'
+      }
+    });
+    expect(res1.status).toBe(401);
+
+    const res2 = await adminAgent.resource('users').updateProfile({
+      filterByTk: adminUser.id,
+      values: {
+        nickname: 'a'
+      }
+    });
+    expect(res2.status).toBe(200);
+  });
 });
diff --git a/packages/plugins/users/src/actions/users.ts b/packages/plugins/users/src/actions/users.ts
index 481d19848a..0cabfc4b69 100644
--- a/packages/plugins/users/src/actions/users.ts
+++ b/packages/plugins/users/src/actions/users.ts
@@ -107,11 +107,16 @@ export async function getUserByResetToken(ctx: Context, next: Next) {
 
 export async function updateProfile(ctx: Context, next: Next) {
   const { values } = ctx.action.params;
-  if (!ctx.state.currentUser) {
+  const { currentUser } = ctx.state;
+  if (!currentUser) {
     ctx.throw(401);
   }
-  await ctx.state.currentUser.update(values);
-  ctx.body = ctx.state.currentUser;
+  const UserRepo = ctx.db.getRepository('users');
+  const result = await UserRepo.update({
+    filterByTk: currentUser.id,
+    values
+  });
+  ctx.body = result;
   await next();
 }