diff --git a/changelog/unreleased/issue-2951 b/changelog/unreleased/issue-2951
new file mode 100644
index 000000000..e7f2e4793
--- /dev/null
+++ b/changelog/unreleased/issue-2951
@@ -0,0 +1,9 @@
+Bugfix: restic generate, help and self-update no longer check passwords
+
+The commands `restic cache`, `generate`, `help` and `self-update` don't need
+passwords, but they previously did run the RESTIC_PASSWORD_COMMAND (if set in
+the environment), prompting users to authenticate for no reason. They now skip
+running the password command.
+
+https://github.com/restic/restic/issues/2951
+https://github.com/restic/restic/pull/2987
diff --git a/cmd/restic/main.go b/cmd/restic/main.go
index 2e75575b3..0f09b6746 100644
--- a/cmd/restic/main.go
+++ b/cmd/restic/main.go
@@ -51,7 +51,7 @@ directories in an encrypted repository stored on different backends.
 			return err
 		}
 		globalOptions.extended = opts
-		if c.Name() == "version" {
+		if !needsPassword(c.Name()) {
 			return nil
 		}
 		pwd, err := resolvePassword(globalOptions, "RESTIC_PASSWORD")
@@ -71,6 +71,18 @@ directories in an encrypted repository stored on different backends.
 	},
 }
 
+// Distinguish commands that need the password from those that work without,
+// so we don't run $RESTIC_PASSWORD_COMMAND for no reason (it might prompt the
+// user for authentication).
+func needsPassword(cmd string) bool {
+	switch cmd {
+	case "cache", "generate", "help", "options", "self-update", "version":
+		return false
+	default:
+		return true
+	}
+}
+
 var logBuffer = bytes.NewBuffer(nil)
 
 func init() {