diff --git a/.changelog/752.txt b/.changelog/752.txt
new file mode 100644
index 000000000..bdf7288c8
--- /dev/null
+++ b/.changelog/752.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+resource/deployment: Update the elasticsearch_username when resetting the password.
+```
diff --git a/ec/acc/deployment_basic_test.go b/ec/acc/deployment_basic_test.go
index f2c0ce670..b77fa0e3b 100644
--- a/ec/acc/deployment_basic_test.go
+++ b/ec/acc/deployment_basic_test.go
@@ -98,6 +98,7 @@ func TestAccDeployment_basic_tf(t *testing.T) {
 				ExpectNonEmptyPlan: true, // reset_elasticsearch_password will always result in a non-empty plan
 				Check: checkBasicDeploymentResource(resName, randomName, deploymentVersion,
 					resource.TestCheckResourceAttr(resName, "traffic_filter.#", "0"),
+					resource.TestCheckResourceAttr(resName, "elasticsearch_username", "elastic"),
 					func(s *terraform.State) error {
 						currentPw, ok := captureElasticsearchPassword(s, resName)
 						if !ok {
diff --git a/ec/ecresource/deploymentresource/update.go b/ec/ecresource/deploymentresource/update.go
index 609b8f944..fa2600c0b 100644
--- a/ec/ecresource/deploymentresource/update.go
+++ b/ec/ecresource/deploymentresource/update.go
@@ -94,18 +94,19 @@ func (r *Resource) Update(ctx context.Context, req resource.UpdateRequest, resp
 	}
 
 	if plan.ResetElasticsearchPassword.ValueBool() {
-		newPassword, diags := r.ResetElasticsearchPassword(plan.Id.ValueString(), *deployment.Elasticsearch.RefId)
+		newUsername, newPassword, diags := r.ResetElasticsearchPassword(plan.Id.ValueString(), *deployment.Elasticsearch.RefId)
 		if resp.Diagnostics.Append(diags...); resp.Diagnostics.HasError() {
 			return
 		}
 
+		deployment.ElasticsearchUsername = newUsername
 		deployment.ElasticsearchPassword = newPassword
 	}
 
 	resp.Diagnostics.Append(resp.State.Set(ctx, deployment)...)
 }
 
-func (r *Resource) ResetElasticsearchPassword(deploymentID string, refID string) (string, diag.Diagnostics) {
+func (r *Resource) ResetElasticsearchPassword(deploymentID string, refID string) (string, string, diag.Diagnostics) {
 	var diags diag.Diagnostics
 
 	resetResp, err := depresourceapi.ResetElasticsearchPassword(depresourceapi.ResetElasticsearchPasswordParams{
@@ -116,10 +117,10 @@ func (r *Resource) ResetElasticsearchPassword(deploymentID string, refID string)
 
 	if err != nil {
 		diags.AddError("failed to reset elasticsearch password", err.Error())
-		return "", diags
+		return "", "", diags
 	}
 
-	return *resetResp.Password, diags
+	return *resetResp.Username, *resetResp.Password, diags
 }
 
 func HandleTrafficFilterChange(ctx context.Context, client *api.API, plan v2.DeploymentTF, stateRules ruleSet) ([]string, diag.Diagnostics) {