diff --git a/app/routes/inspections.py b/app/routes/inspections.py
index dbade61..cacd43f 100644
--- a/app/routes/inspections.py
+++ b/app/routes/inspections.py
@@ -344,6 +344,13 @@ def execute(inspection_id):
             flash('Inspection submitted successfully!', 'success')
             return redirect(url_for('inspections.view', inspection_id=inspection_id))
 
+        elif action == 'flag':
+            # Save current form state as a draft so no work is lost,
+            # then send the inspector to the issue creation page.
+            _save_draft(inspection, responses)
+            db.session.commit()
+            return redirect(url_for('inspections.flag_issue', inspection_id=inspection_id))
+
         else:  # save draft
             _save_draft(inspection, responses)
             db.session.commit()
diff --git a/app/templates/inspections/execute.html b/app/templates/inspections/execute.html
index 55d8862..a026741 100644
--- a/app/templates/inspections/execute.html
+++ b/app/templates/inspections/execute.html
@@ -214,10 +214,11 @@
     </div>
     <div class="d-flex gap-2 align-items-center">
       <span class="freq-badge">{{ inspection.template.frequency|title }}</span>
-      <a href="{{ url_for('inspections.flag_issue', inspection_id=inspection.id) }}"
-         class="btn btn-sm btn-outline-danger btn-outline-light">
+      <button type="submit" name="action" value="flag"
+              class="btn btn-sm btn-outline-danger btn-outline-light"
+              onclick="return confirm('Your current progress will be saved automatically. Continue to flag an issue?')">
         <i class="bi bi-exclamation-triangle"></i> Flag Issue
-      </a>
+      </button>
     </div>
   </div>
 
diff --git a/app/utils/forms.py b/app/utils/forms.py
index ee3b5df..23eceac 100644
--- a/app/utils/forms.py
+++ b/app/utils/forms.py
@@ -46,8 +46,8 @@ class ProfileForm(FlaskForm):
 class UserForm(FlaskForm):
     username        = StringField('Username', validators=[DataRequired(), Length(min=3, max=100)])
     email           = StringField('Email', validators=[DataRequired(), Email(), Length(max=255)])
-    password        = PasswordField('Password', validators=[Length(min=6, max=100)])
-    confirm_password = PasswordField('Confirm Password', validators=[EqualTo('password')])
+    password        = PasswordField('Password', validators=[Optional(), Length(min=6, max=100)])
+    confirm_password = PasswordField('Confirm Password', validators=[Optional(), EqualTo('password')])
     role            = SelectField('Role', choices=[
         ('admin', 'Administrator'), ('supervisor', 'Supervisor'), ('inspector', 'Inspector')
     ], validators=[DataRequired()])
@@ -56,6 +56,16 @@ class UserForm(FlaskForm):
         super().__init__(*args, **kwargs)
         self.user = user
 
+    def validate_password(self, field):
+        """Enforce minimum length only when a new password is actually provided."""
+        if field.data and len(field.data) < 6:
+            raise ValidationError('Password must be at least 6 characters.')
+
+    def validate_confirm_password(self, field):
+        """Require confirmation to match only when a new password is provided."""
+        if self.password.data and field.data != self.password.data:
+            raise ValidationError('Passwords must match.')
+
     def validate_username(self, field):
         q = User.query.filter_by(username=field.data).first()
         if self.user: