diff --git a/CHANGELOG.md b/CHANGELOG.md
index e093f1f9..d8c5ab7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,15 @@ All notable changes to the Pollora framework will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased](https://github.com/Pollora/framework/compare/v13.37.1...develop)
+## [Unreleased](https://github.com/Pollora/framework/compare/v13.38.0...develop)
+
+## [v13.38.0](https://github.com/Pollora/framework/compare/v13.37.1...v13.38.0) - 2026-10-21
+
+### Fixed
+- The setup (`pollora:env:setup`, `pollora:install`) accepts an empty database password. A local MySQL with `root` and no password, the default with Homebrew, MAMP and many Docker images, was refused with "Database password is required" and had to be written into `.env` by hand. The connection test that follows still decides whether the empty password works, and `DB_PASSWORD=` is written as an empty value (#515)
+
+### Changed
+- The framework requires Laravel 13.38 (`illuminate/*` `^13.38`)
 
 ## [v13.37.1](https://github.com/Pollora/framework/compare/v13.37.0...v13.37.1) - 2026-10-20
 
diff --git a/README.md b/README.md
index c4f6d670..6be1ffce 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,7 @@ composer create-project pollora/pollora my-project
 Requirements:
 
 - PHP 8.4+ for a new project (the skeleton's lock file ships Symfony 8; this package alone accepts PHP 8.3)
-- Laravel 13.37 (Pollora's version numbers follow the Laravel release it is built on)
+- Laravel 13.38 (Pollora's version numbers follow the Laravel release it is built on)
 - WordPress 7.1+
 
 ## Quick start
diff --git a/composer.json b/composer.json
index 328f7746..02b35db7 100644
--- a/composer.json
+++ b/composer.json
@@ -24,11 +24,11 @@
     "require": {
         "php": "^8.3",
         "pollora/helper-overrider": "^1.2",
-        "illuminate/auth": "^13.37",
-        "illuminate/support": "^13.37",
-        "illuminate/database": "^13.37",
-        "illuminate/routing": "^13.37",
-        "illuminate/console": "^13.37",
+        "illuminate/auth": "^13.38",
+        "illuminate/support": "^13.38",
+        "illuminate/database": "^13.38",
+        "illuminate/routing": "^13.38",
+        "illuminate/console": "^13.38",
         "pollora/abilities": "^1.0",
         "pollora/ajax": "^1.1",
         "pollora/assets": "^0.1",
@@ -54,7 +54,7 @@
         "coduo/php-humanizer": "5.0.3",
         "nwidart/laravel-modules": "^13.0",
         "symfony/process": "^7.4 || ^8.0",
-        "illuminate/config": "^13.37",
+        "illuminate/config": "^13.38",
         "laravel/prompts": "^0.3.25"
     },
     "autoload": {
diff --git a/src/Services/WordPress/Installation/DTO/DatabaseConfig.php b/src/Services/WordPress/Installation/DTO/DatabaseConfig.php
index 9aefa672..e1131faa 100755
--- a/src/Services/WordPress/Installation/DTO/DatabaseConfig.php
+++ b/src/Services/WordPress/Installation/DTO/DatabaseConfig.php
@@ -91,7 +91,7 @@ public static function fromPrompts(): self
             ),
             password: password(
                 label: 'Database password?',
-                required: 'Database password is required'
+                hint: 'Leave empty if the database user has no password.'
             ),
             siteUrl: text(
                 label: 'Site URL?',
diff --git a/tests/Feature/WordPress/EnvironmentFileHandlerTest.php b/tests/Feature/WordPress/EnvironmentFileHandlerTest.php
new file mode 100644
index 00000000..3ac72483
--- /dev/null
+++ b/tests/Feature/WordPress/EnvironmentFileHandlerTest.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Support\Facades\File;
+use Pollora\Services\WordPress\Database\EnvironmentFileHandler;
+
+beforeEach(function (): void {
+    // The handler looks for .env relative to the working directory, as Artisan runs from the project root.
+    $this->workingDirectory = getcwd();
+    chdir(base_path());
+
+    $this->envPath = base_path('.env');
+    $this->hadEnv = File::exists($this->envPath);
+    $this->previous = $this->hadEnv ? File::get($this->envPath) : null;
+
+    File::put($this->envPath, "APP_NAME=Pollora\nDB_USERNAME=root\nDB_PASSWORD=old\n");
+});
+
+afterEach(function (): void {
+    chdir($this->workingDirectory);
+
+    if ($this->hadEnv) {
+        File::put($this->envPath, $this->previous);
+    } else {
+        File::delete($this->envPath);
+    }
+});
+
+it('writes an empty database password as an empty value', function (): void {
+    (new EnvironmentFileHandler)->updateEnvFile(['DB_PASSWORD' => '']);
+
+    $lines = explode("\n", File::get($this->envPath));
+
+    expect($lines)->toContain('DB_PASSWORD=')
+        ->and($lines)->toContain('DB_USERNAME=root');
+});
diff --git a/tests/Unit/Services/WordPress/Installation/DatabaseConfigTest.php b/tests/Unit/Services/WordPress/Installation/DatabaseConfigTest.php
new file mode 100644
index 00000000..ebf51866
--- /dev/null
+++ b/tests/Unit/Services/WordPress/Installation/DatabaseConfigTest.php
@@ -0,0 +1,44 @@
+<?php
+
+declare(strict_types=1);
+
+use Laravel\Prompts\Key;
+use Laravel\Prompts\Prompt;
+use Pollora\Services\WordPress\Installation\DTO\DatabaseConfig;
+
+/**
+ * Answers the six prompts of the database setup: host, port, name, username,
+ * password and site URL. The defaults are kept, except for the name, which has none.
+ *
+ * @param  list<string>  $password  The keys typed at the password prompt
+ * @return list<string>
+ */
+function databasePromptKeys(array $password): array
+{
+    return [
+        Key::ENTER,
+        Key::ENTER,
+        ...str_split('pollora'),
+        Key::ENTER,
+        Key::ENTER,
+        ...$password,
+        Key::ENTER,
+        Key::ENTER,
+    ];
+}
+
+it('accepts an empty database password', function (): void {
+    Prompt::fake(databasePromptKeys([]));
+
+    $config = DatabaseConfig::fromPrompts();
+
+    expect($config->password)->toBe('')
+        ->and($config->name)->toBe('pollora')
+        ->and($config->username)->toBe('root');
+});
+
+it('still takes a database password that is typed', function (): void {
+    Prompt::fake(databasePromptKeys(str_split('s3cret')));
+
+    expect(DatabaseConfig::fromPrompts()->password)->toBe('s3cret');
+});