diff --git a/web/src/lib/api/orgProfile.test.ts b/web/src/lib/api/orgProfile.test.ts
index c19b1f3cd..daaa1f544 100644
--- a/web/src/lib/api/orgProfile.test.ts
+++ b/web/src/lib/api/orgProfile.test.ts
@@ -4,7 +4,11 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import { getOrCreateDelegatedSession } from "#lib/api/actAs.ts";
 import { awaitIndexedOrSaved } from "#lib/api/awaitRecord.ts";
 import { createBobbinClient } from "#lib/api/client.ts";
-import { saveOrganizationAvatar, saveOrganizationProfile } from "#lib/api/orgProfile.ts";
+import {
+	organizationHandleAgent,
+	saveOrganizationAvatar,
+	saveOrganizationProfile
+} from "#lib/api/orgProfile.ts";
 import { putProfile, uploadProfileAvatar } from "#lib/api/profile.ts";
 
 vi.mock("#lib/api/actAs.ts", () => ({ getOrCreateDelegatedSession: vi.fn() }));
@@ -45,6 +49,46 @@ describe("saveOrganizationProfile", () => {
 	});
 });
 
+describe("organizationHandleAgent", () => {
+	const withScope = (sub: string, scope: string) =>
+		({ sub, session: { token: { scope } }, signOut: vi.fn() }) as unknown as OAuthUserAgent;
+	const granted = "atproto identity:handle";
+
+	it("uses the stored organization session when it can change the handle", async () => {
+		const stored = withScope(orgDid, "atproto identity:*");
+		vi.mocked(getOrCreateDelegatedSession).mockResolvedValue(stored);
+
+		await expect(
+			organizationHandleAgent(withScope("did:plc:controller", granted), orgDid)
+		).resolves.toBe(stored);
+		expect(stored.signOut).not.toHaveBeenCalled();
+	});
+
+	it("replaces an organization session from before the owner allowed handle changes", async () => {
+		const stale = withScope(orgDid, "atproto repo:*");
+		const fresh = withScope(orgDid, "atproto identity:*");
+		vi.mocked(getOrCreateDelegatedSession)
+			.mockResolvedValueOnce(stale)
+			.mockResolvedValueOnce(fresh);
+		vi.mocked(stale.signOut).mockResolvedValue();
+
+		await expect(
+			organizationHandleAgent(withScope("did:plc:controller", granted), orgDid)
+		).resolves.toBe(fresh);
+		expect(stale.signOut).toHaveBeenCalled();
+	});
+
+	it("keeps the organization session while the owner's own session can't change handles", async () => {
+		const stale = withScope(orgDid, "atproto repo:*");
+		vi.mocked(getOrCreateDelegatedSession).mockResolvedValue(stale);
+
+		await expect(
+			organizationHandleAgent(withScope("did:plc:controller", "atproto repo:*"), orgDid)
+		).resolves.toBe(stale);
+		expect(stale.signOut).not.toHaveBeenCalled();
+	});
+});
+
 describe("saveOrganizationAvatar", () => {
 	it("uploads with the organization's session, starting a record if there is none", async () => {
 		const image = new Blob(["png"], { type: "image/png" });
diff --git a/web/src/lib/api/orgProfile.ts b/web/src/lib/api/orgProfile.ts
index 27d1e4de9..215ab0cc6 100644
--- a/web/src/lib/api/orgProfile.ts
+++ b/web/src/lib/api/orgProfile.ts
@@ -1,6 +1,7 @@
 import type { Did } from "@atcute/lexicons/syntax";
-import type { OAuthUserAgent } from "@atcute/oauth-browser-client";
+import { deleteStoredSession, type OAuthUserAgent } from "@atcute/oauth-browser-client";
 import { getOrCreateDelegatedSession } from "#lib/api/actAs.ts";
+import { canChangeHandle } from "#lib/api/handle.ts";
 import { PROFILE_COLLECTION } from "#lib/api/profile.ts";
 import type { BobbinContext } from "#lib/api/client.ts";
 import { saveAvatar, writeProfile } from "#lib/api/profileSettings.ts";
@@ -17,6 +18,17 @@ export const saveOrganizationProfile = async (
 	return writeProfile(ctx, orgAgent, written);
 };
 
+// an organization session made before its owner allowed handle changes keeps the old scope
+export const organizationHandleAgent = async (
+	controllerAgent: OAuthUserAgent,
+	orgDid: Did
+): Promise<OAuthUserAgent> => {
+	const orgAgent = await getOrCreateDelegatedSession(controllerAgent, orgDid);
+	if (canChangeHandle(orgAgent) || !canChangeHandle(controllerAgent)) return orgAgent;
+	await orgAgent.signOut().catch(() => deleteStoredSession(orgDid));
+	return getOrCreateDelegatedSession(controllerAgent, orgDid);
+};
+
 export const saveOrganizationAvatar = async (
 	ctx: BobbinContext,
 	controllerAgent: OAuthUserAgent,
diff --git a/web/src/routes/[handle]/settings/OrganizationHandle.svelte b/web/src/routes/[handle]/settings/OrganizationHandle.svelte
new file mode 100644
index 000000000..0b8028e20
--- /dev/null
+++ b/web/src/routes/[handle]/settings/OrganizationHandle.svelte
@@ -0,0 +1,41 @@
+<script lang="ts">
+	import { goto } from "$app/navigation";
+	import { resolve } from "$app/paths";
+	import type { Did, Handle } from "@atcute/lexicons/syntax";
+	import { createLoad } from "#lib/action.svelte.ts";
+	import { profileIdentifier } from "#lib/api/identity.ts";
+	import { organizationHandleAgent } from "#lib/api/orgProfile.ts";
+	import { getAuth } from "#lib/auth.svelte.ts";
+	import ChangeHandleForm from "#lib/components/settings/ChangeHandleForm.svelte";
+	import Error from "#lib/components/ui/Error.svelte";
+
+	interface Props {
+		identity: { did: Did; handle: Handle };
+		owner: boolean;
+	}
+
+	let { identity, owner }: Props = $props();
+
+	const auth = getAuth();
+	const agent = createLoad(async () => {
+		const controller = auth.agent;
+		if (!controller || !owner) return null;
+		return organizationHandleAgent(controller, identity.did);
+	});
+</script>
+
+{#if !owner}
+	<Error size="large" label="Only owners can change the organization's handle." />
+{:else if agent.error}
+	<Error size="large" label={agent.error} />
+{:else}
+	<ChangeHandleForm
+		agent={agent.data ?? null}
+		did={identity.did}
+		handle={identity.handle}
+		backHref={`/${profileIdentifier(identity.handle, identity.did)}?tab=settings`}
+		onsaved={async () => {
+			await goto(resolve(`/${identity.did}?tab=settings` as "/"));
+		}}
+	/>
+{/if}
diff --git a/web/src/routes/[handle]/settings/OrganizationProfileTab.stories.svelte b/web/src/routes/[handle]/settings/OrganizationProfileTab.stories.svelte
index 911575141..5d7f86c6d 100644
--- a/web/src/routes/[handle]/settings/OrganizationProfileTab.stories.svelte
+++ b/web/src/routes/[handle]/settings/OrganizationProfileTab.stories.svelte
@@ -38,6 +38,7 @@
 			`/${identity.handle}?tab=settings&section=avatar`
 		);
 		await expect(canvas.getByRole("textbox", { name: "Bio" })).toBeVisible();
+		await expect(canvas.queryByRole("link", { name: "Change" })).not.toBeInTheDocument();
 		await expect(
 			canvas.queryByRole("button", { name: "Delete organization" })
 		).not.toBeInTheDocument();
@@ -53,6 +54,17 @@
 	}}
 />
 
+<Story
+	name="Owner can change the handle"
+	args={{ identity, profile: null, owner: true }}
+	play={async ({ canvas }) => {
+		await expect(canvas.getByRole("link", { name: "Change" })).toHaveAttribute(
+			"href",
+			`/${identity.handle}?tab=settings&section=handle`
+		);
+	}}
+/>
+
 <Story
 	name="Prefilled from the stored record"
 	args={{ identity, profile: record }}
diff --git a/web/src/routes/[handle]/settings/OrganizationProfileTab.svelte b/web/src/routes/[handle]/settings/OrganizationProfileTab.svelte
index 86f78d921..21df9dad3 100644
--- a/web/src/routes/[handle]/settings/OrganizationProfileTab.svelte
+++ b/web/src/routes/[handle]/settings/OrganizationProfileTab.svelte
@@ -2,18 +2,23 @@
 	import { profileIdentifier } from "#lib/api/identity.ts";
 	import type { Did, Handle } from "@atcute/lexicons/syntax";
 	import { refreshAll } from "$app/navigation";
+	import { resolve } from "$app/paths";
 	import { getAuth } from "#lib/auth.svelte.ts";
 	import { createBobbinClient } from "#lib/api/client.ts";
 	import { saveOrganizationProfile } from "#lib/api/orgProfile.ts";
 	import type { ProfileRecord } from "#lib/api/records.ts";
 	import ProfileSettingsForm from "#lib/components/settings/ProfileSettingsForm.svelte";
+	import Button from "#lib/components/ui/Button.svelte";
 
 	interface Props {
 		identity: { did: Did; handle: Handle };
 		profile: ProfileRecord | null;
+		owner?: boolean;
 	}
 
-	let { identity, profile }: Props = $props();
+	let { identity, profile, owner = false }: Props = $props();
+
+	const base = $derived(`/${profileIdentifier(identity.handle, identity.did)}?tab=settings`);
 
 	const auth = getAuth();
 
@@ -31,7 +36,13 @@
 	did={identity.did}
 	handle={identity.handle}
 	{profile}
-	avatarHref={`/${profileIdentifier(identity.handle, identity.did)}?tab=settings&section=avatar`}
+	avatarHref={`${base}&section=avatar`}
 	description="How this organization appears across Tangled."
 	onsave={save}
-/>
+>
+	{#snippet handleAction()}
+		{#if owner}
+			<Button variant="ghost" href={resolve(`${base}&section=handle` as "/")}>Change</Button>
+		{/if}
+	{/snippet}
+</ProfileSettingsForm>
diff --git a/web/src/routes/[handle]/settings/OrganizationSettingsTab.svelte b/web/src/routes/[handle]/settings/OrganizationSettingsTab.svelte
index b69b0b832..3d31a76e6 100644
--- a/web/src/routes/[handle]/settings/OrganizationSettingsTab.svelte
+++ b/web/src/routes/[handle]/settings/OrganizationSettingsTab.svelte
@@ -3,7 +3,7 @@
 	import { profileIdentifier } from "#lib/api/identity.ts";
 	import { page } from "$app/state";
 	import { createLoad } from "#lib/action.svelte.ts";
-	import { viewerControlsOrganization } from "#lib/api/organizations.ts";
+	import { viewerControlsOrganization, viewerOwnsOrganization } from "#lib/api/organizations.ts";
 	import type { ProfileRecord } from "#lib/api/records.ts";
 	import { getAuth } from "#lib/auth.svelte.ts";
 	import settingsSettingspanelContentSkeletonFixture from "#lib/bones/settings-settingspanel--content-skeleton-fixture.bones.json";
@@ -17,6 +17,7 @@
 	import InviteMembers from "#routes/[handle]/settings/members/InviteMembers.svelte";
 	import MembersTab from "#routes/[handle]/settings/members/MembersTab.svelte";
 	import OrganizationAvatar from "#routes/[handle]/settings/OrganizationAvatar.svelte";
+	import OrganizationHandle from "#routes/[handle]/settings/OrganizationHandle.svelte";
 	import OrganizationProfileTab from "#routes/[handle]/settings/OrganizationProfileTab.svelte";
 	import User from "$icon/user-round";
 	import Volleyball from "$icon/volleyball";
@@ -38,6 +39,11 @@
 		if (!agent || !delegationDid || !profile?.isOrganization) return false;
 		return viewerControlsOrganization(agent, delegationDid, identity.did);
 	});
+	const owns = createLoad(async () => {
+		const agent = auth.agent;
+		if (!agent || !controls.data) return false;
+		return viewerOwnsOrganization(agent, delegationDid, identity.did);
+	});
 
 	const base = $derived(`/${profileIdentifier(identity.handle, identity.did)}?tab=settings`);
 	const items: SettingsNavItem[] = $derived([
@@ -50,7 +56,11 @@
 
 	const section = $derived(page.url.searchParams.get("section") ?? "profile");
 	const active = $derived(
-		section === "avatar" ? "profile" : section === "invite" ? "members" : section
+		section === "avatar" || section === "handle"
+			? "profile"
+			: section === "invite"
+				? "members"
+				: section
 	);
 </script>
 
@@ -64,6 +74,10 @@
 	<SettingsPanel {items} {active} label="Organization" framed={false}>
 		{#if section === "avatar"}
 			<OrganizationAvatar {identity} {profile} />
+		{:else if section === "handle"}
+			{#if owns.data !== undefined}
+				<OrganizationHandle {identity} owner={owns.data} />
+			{/if}
 		{:else if section === "knots"}
 			<KnotsTab />
 		{:else if section === "spindles"}
@@ -75,7 +89,7 @@
 		{:else if section === "invite"}
 			<InviteMembers handle={identity.handle} did={identity.did} />
 		{:else}
-			<OrganizationProfileTab {identity} {profile} />
+			<OrganizationProfileTab {identity} {profile} owner={owns.data} />
 		{/if}
 	</SettingsPanel>
 {:else}