diff --git a/doc/api/project_packages_protection_rules.md b/doc/api/project_packages_protection_rules.md
index 77d6811a55bf53ca5f3d91454d0ffa8a926d105c..9e3286e194d8ffd654c366130f2c31d3c38dab71 100644
--- a/doc/api/project_packages_protection_rules.md
+++ b/doc/api/project_packages_protection_rules.md
@@ -114,6 +114,47 @@ curl --request POST \
     }'
 ```
 
+### Update a package protection rule
+
+Update a package protection rule for a project.
+
+```plaintext
+PATCH /api/v4/projects/:id/packages/protection/rules/:package_protection_rule_id
+```
+
+Supported attributes:
+
+| Attribute                             | Type            | Required | Description                    |
+|---------------------------------------|-----------------|----------|--------------------------------|
+| `id`                                  | integer/string  | Yes      | ID or [URL-encoded path of the project](rest/index.md#namespaced-path-encoding) owned by the authenticated user. |
+| `package_protection_rule_id`           | integer        | Yes      | ID of the package protection rule to be updated. |
+| `package_name_pattern`                | string          | No      | Package name protected by the protection rule. For example `@my-scope/my-package-*`. Wildcard character `*` allowed. |
+| `package_type`                        | string          | No      | Package type protected by the protection rule. For example `npm`. |
+| `minimum_access_level_for_push`   | string          | No      | Minimum GitLab access level able to push a package. For example `developer`, `maintainer`, `owner`. |
+
+If successful, returns [`200`](rest/index.md#status-codes) and the updated package protection rule.
+
+Can return the following status codes:
+
+- `200 OK`: The package protection rule was patched successfully.
+- `400 Bad Request`: The patch is invalid.
+- `401 Unauthorized`: The access token is invalid.
+- `403 Forbidden`: The user does not have permission to patch a package protection rule.
+- `404 Not Found`: The project was not found.
+- `422 Unprocessable Entity`: The package protection rule could not be patched, for example, because the `package_name_pattern` is already taken.
+
+Example request:
+
+```shell
+curl --request PATCH \
+  --header "PRIVATE-TOKEN: <your_access_token>" \
+  --header "Content-Type: application/json" \
+  --url "https://gitlab.example.com/api/v4/projects/7/packages/protection/rules/32" \
+  --data '{
+       "package_name_pattern": "new-package-name-pattern-*"
+    }'
+```
+
 ## Delete a package protection rule
 
 Deletes a package protection rule from a project.
diff --git a/lib/api/project_packages_protection_rules.rb b/lib/api/project_packages_protection_rules.rb
index a86ac8fb07686cb0ef2000926eac4c0a9298a987..1dd0dbaa641495e33e4f4d6f07a4ae3fd0e9f92c 100644
--- a/lib/api/project_packages_protection_rules.rb
+++ b/lib/api/project_packages_protection_rules.rb
@@ -18,70 +18,111 @@ class ProjectPackagesProtectionRules < ::API::Base
       requires :id, types: [String, Integer], desc: 'The ID or URL-encoded path of the project'
     end
     resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
-      desc 'Get list of package protection rules for a project' do
-        success Entities::Projects::Packages::Protection::Rule
-        failure [
-          { code: 401, message: 'Unauthorized' },
-          { code: 403, message: 'Forbidden' },
-          { code: 404, message: 'Not Found' }
-        ]
-        tags %w[projects]
-        is_array true
-      end
-      get ':id/packages/protection/rules' do
-        present user_project.package_protection_rules, with: Entities::Projects::Packages::Protection::Rule
-      end
+      resource ':id/packages/protection/rules' do
+        desc 'Get list of package protection rules for a project' do
+          success Entities::Projects::Packages::Protection::Rule
+          failure [
+            { code: 401, message: 'Unauthorized' },
+            { code: 403, message: 'Forbidden' },
+            { code: 404, message: 'Not Found' }
+          ]
+          tags %w[projects]
+          is_array true
+          hidden true
+        end
+        get do
+          present user_project.package_protection_rules, with: Entities::Projects::Packages::Protection::Rule
+        end
 
-      desc 'Create a package protection rule for a project' do
-        success Entities::Projects::Packages::Protection::Rule
-        failure [
-          { code: 400, message: 'Bad Request' },
-          { code: 401, message: 'Unauthorized' },
-          { code: 403, message: 'Forbidden' },
-          { code: 404, message: 'Not Found' },
-          { code: 422, message: 'Unprocessable Entity' }
-        ]
-        tags %w[projects]
-      end
-      params do
-        requires :package_name_pattern, type: String,
-          desc: 'Package name protected by the rule. For example @my-scope/my-package-*. Wildcard character * allowed.'
-        requires :package_type, type: String, values: Packages::Protection::Rule.package_types.keys,
-          desc: 'Package type protected by the rule. For example npm.'
-        requires :minimum_access_level_for_push, type: String,
-          values: Packages::Protection::Rule.minimum_access_level_for_pushes.keys,
-          desc: 'Minimum GitLab access level able to push a package. For example developer, maintainer, owner.'
-      end
-      post ':id/packages/protection/rules' do
-        response = ::Packages::Protection::CreateRuleService.new(project: user_project, current_user: current_user,
-          params: declared_params(params)).execute
+        desc 'Create a package protection rule for a project' do
+          success Entities::Projects::Packages::Protection::Rule
+          failure [
+            { code: 400, message: 'Bad Request' },
+            { code: 401, message: 'Unauthorized' },
+            { code: 403, message: 'Forbidden' },
+            { code: 404, message: 'Not Found' },
+            { code: 422, message: 'Unprocessable Entity' }
+          ]
+          tags %w[projects]
+          hidden true
+        end
+        params do
+          requires :package_name_pattern, type: String,
+            desc: 'Package name protected by the rule. For example @my-scope/my-package-*.
+            Wildcard character * allowed.'
+          requires :package_type, type: String, values: Packages::Protection::Rule.package_types.keys,
+            desc: 'Package type protected by the rule. For example npm.'
+          requires :minimum_access_level_for_push, type: String,
+            values: Packages::Protection::Rule.minimum_access_level_for_pushes.keys,
+            desc: 'Minimum GitLab access level able to push a package. For example developer, maintainer, owner.'
+        end
+        post do
+          response = ::Packages::Protection::CreateRuleService.new(project: user_project, current_user: current_user,
+            params: declared_params).execute
 
-        render_api_error!({ error: response.message }, :unprocessable_entity) if response.error?
+          render_api_error!({ error: response.message }, :unprocessable_entity) if response.error?
 
-        present response[:package_protection_rule], with: Entities::Projects::Packages::Protection::Rule
-      end
+          present response[:package_protection_rule], with: Entities::Projects::Packages::Protection::Rule
+        end
 
-      desc 'Delete package protection rule' do
-        success code: 204, message: '204 No Content'
-        failure [
-          { code: 400, message: 'Bad Request' },
-          { code: 401, message: 'Unauthorized' },
-          { code: 403, message: 'Forbidden' },
-          { code: 404, message: 'Not Found' }
-        ]
-        tags %w[projects]
-      end
-      params do
-        requires :package_protection_rule_id, type: Integer, desc: 'The ID of the package protection rule'
-      end
-      delete ':id/packages/protection/rules/:package_protection_rule_id' do
-        package_protection_rule = user_project.package_protection_rules.find(params[:package_protection_rule_id])
+        params do
+          requires :package_protection_rule_id, type: Integer, desc: 'The ID of the package protection rule'
+        end
+        resource ':package_protection_rule_id' do
+          desc 'Update a package protection rule for a project' do
+            success Entities::Projects::Packages::Protection::Rule
+            failure [
+              { code: 400, message: 'Bad Request' },
+              { code: 401, message: 'Unauthorized' },
+              { code: 403, message: 'Forbidden' },
+              { code: 404, message: 'Not Found' },
+              { code: 422, message: 'Unprocessable Entity' }
+            ]
+            tags %w[projects]
+            hidden true
+          end
+          params do
+            optional :package_name_pattern, type: String,
+              desc: 'Package name protected by the rule. For example @my-scope/my-package-*.
+              Wildcard character * allowed.'
+            optional :package_type, type: String, values: Packages::Protection::Rule.package_types.keys,
+              desc: 'Package type protected by the rule. For example npm.'
+            optional :minimum_access_level_for_push, type: String,
+              values: Packages::Protection::Rule.minimum_access_level_for_pushes.keys,
+              desc: 'Minimum GitLab access level able to push a package. For example developer, maintainer, owner.'
+          end
+          patch do
+            package_protection_rule = user_project.package_protection_rules.find(params[:package_protection_rule_id])
+
+            response = ::Packages::Protection::UpdateRuleService.new(package_protection_rule,
+              current_user: current_user, params: declared_params(include_missing: false)).execute
+
+            render_api_error!({ error: response.message }, :unprocessable_entity) if response.error?
+
+            present response[:package_protection_rule], with: Entities::Projects::Packages::Protection::Rule
+          end
+
+          desc 'Delete package protection rule' do
+            success code: 204, message: '204 No Content'
+            failure [
+              { code: 400, message: 'Bad Request' },
+              { code: 401, message: 'Unauthorized' },
+              { code: 403, message: 'Forbidden' },
+              { code: 404, message: 'Not Found' }
+            ]
+            tags %w[projects]
+            hidden true
+          end
+          delete do
+            package_protection_rule = user_project.package_protection_rules.find(params[:package_protection_rule_id])
 
-        destroy_conditionally!(package_protection_rule) do |package_protection_rule|
-          response = ::Packages::Protection::DeleteRuleService.new(package_protection_rule,
-            current_user: current_user).execute
+            destroy_conditionally!(package_protection_rule) do |package_protection_rule|
+              response = ::Packages::Protection::DeleteRuleService.new(package_protection_rule,
+                current_user: current_user).execute
 
-          render_api_error!({ error: response.message }, :bad_request) if response.error?
+              render_api_error!({ error: response.message }, :bad_request) if response.error?
+            end
+          end
         end
       end
     end
diff --git a/spec/requests/api/project_packages_protection_rules_spec.rb b/spec/requests/api/project_packages_protection_rules_spec.rb
index 95e4216f86d0a3f76a04d4e9f59dab7b142127dc..6cdd71bb682522ac781b1987bdd447b0b406c231 100644
--- a/spec/requests/api/project_packages_protection_rules_spec.rb
+++ b/spec/requests/api/project_packages_protection_rules_spec.rb
@@ -15,6 +15,12 @@
   let_it_be(:invalid_token) { 'invalid-token123' }
   let_it_be(:headers_with_invalid_token) { { Gitlab::Auth::AuthFinders::PRIVATE_TOKEN_HEADER => invalid_token } }
 
+  let(:params) do
+    { package_name_pattern: '@my-new-scope/my-package-*',
+      package_type: package_protection_rule.package_type,
+      minimum_access_level_for_push: package_protection_rule.minimum_access_level_for_push }
+  end
+
   shared_examples 'rejecting project packages protection rules request when not enough permissions' do
     using RSpec::Parameterized::TableSyntax
 
@@ -34,6 +40,48 @@
     end
   end
 
+  shared_examples 'rejecting project packages protection rules request when enough permissions' do
+    context 'when feature flag is disabled' do
+      before do
+        stub_feature_flags(packages_protected_packages: false)
+      end
+
+      it_behaves_like 'returning response status', :not_found
+    end
+
+    context 'when the project id is invalid' do
+      let(:url) { "/projects/invalid/packages/protection/rules" }
+
+      it_behaves_like 'returning response status', :not_found
+    end
+
+    context 'when the project id does not exist' do
+      let(:url) { "/projects/#{non_existing_record_id}/packages/protection/rules" }
+
+      it_behaves_like 'returning response status', :not_found
+    end
+  end
+
+  shared_examples 'rejecting project packages protection rules request when handling rule ids' do
+    context 'when the rule id is invalid' do
+      let(:url) { "/projects/#{project.id}/packages/protection/rules/invalid" }
+
+      it_behaves_like 'returning response status', :bad_request
+    end
+
+    context 'when the rule id does not exist' do
+      let(:url) { "/projects/#{project.id}/packages/protection/rules/#{non_existing_record_id}" }
+
+      it_behaves_like 'returning response status', :not_found
+    end
+
+    context 'when the package protection rule does belong to another project' do
+      let(:url) { "/projects/#{other_project.id}/packages/protection/rules/#{package_protection_rule.id}" }
+
+      it_behaves_like 'returning response status', :not_found
+    end
+  end
+
   describe 'GET /projects/:id/packages/protection/rules' do
     let(:url) { "/projects/#{project.id}/packages/protection/rules" }
 
@@ -55,25 +103,7 @@
         expect(json_response.count).to eq(2)
       end
 
-      context 'when the project id is invalid' do
-        let(:url) { "/projects/invalid/packages/protection/rules" }
-
-        it_behaves_like 'returning response status', :not_found
-      end
-
-      context 'when the project id does not exist' do
-        let(:url) { "/projects/#{non_existing_record_id}/packages/protection/rules" }
-
-        it_behaves_like 'returning response status', :not_found
-      end
-
-      context 'when packages_protected_packages is disabled' do
-        before do
-          stub_feature_flags(packages_protected_packages: false)
-        end
-
-        it_behaves_like 'returning response status', :not_found
-      end
+      it_behaves_like 'rejecting project packages protection rules request when enough permissions'
     end
 
     context 'with invalid token' do
@@ -85,11 +115,6 @@
 
   describe 'POST /projects/:id/packages/protection/rules' do
     let(:url) { "/projects/#{project.id}/packages/protection/rules" }
-    let(:params) do
-      { package_name_pattern: '@my-new-scope/my-package-*',
-        package_type: package_protection_rule.package_type,
-        minimum_access_level_for_push: package_protection_rule.minimum_access_level_for_push }
-    end
 
     subject(:post_package_rule) { post(api(url, api_user), params: params) }
 
@@ -136,25 +161,86 @@
         end
       end
 
-      context 'when the project id is invalid' do
-        let(:url) { "/projects/invalid/packages/protection/rules" }
+      it_behaves_like 'rejecting project packages protection rules request when enough permissions'
+    end
+
+    context 'with invalid token' do
+      subject(:post_package_rules) { post(api(url), headers: headers_with_invalid_token, params: params) }
+
+      it_behaves_like 'returning response status', :unauthorized
+    end
+  end
+
+  describe 'PATCH /projects/:id/packages/protection/rules/:package_protection_rule_id' do
+    let(:url) { "/projects/#{project.id}/packages/protection/rules/#{package_protection_rule.id}" }
+
+    subject(:patch_package_rule) { patch(api(url, api_user), params: params) }
 
-        it_behaves_like 'returning response status', :not_found
+    it_behaves_like 'rejecting project packages protection rules request when not enough permissions'
+
+    context 'for maintainer' do
+      let(:api_user) { maintainer }
+      let_it_be(:changed_scope) { '@my-changed-scope/my-package-*' }
+
+      context 'with full changeset' do
+        before do
+          params[:package_name_pattern] = changed_scope
+        end
+
+        it 'updates a package protection rule' do
+          patch_package_rule
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response["package_name_pattern"]).to eq(changed_scope)
+          expect(json_response["package_type"]).to eq(package_protection_rule.package_type)
+        end
+      end
+
+      context 'with a single change' do
+        let(:params) { { package_name_pattern: changed_scope } }
+
+        it 'updates a package protection rule' do
+          patch_package_rule
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response["package_name_pattern"]).to eq(changed_scope)
+        end
+      end
+
+      context 'with invalid package_type' do
+        before do
+          params[:package_type] = "not in enum"
+        end
+
+        it_behaves_like 'returning response status', :bad_request
       end
 
-      context 'when the project id does not exist' do
-        let(:url) { "/projects/#{non_existing_record_id}/packages/protection/rules" }
+      context 'with invalid minimum_access_level_for_push' do
+        before do
+          params[:minimum_access_level_for_push] = "not in enum"
+        end
 
-        it_behaves_like 'returning response status', :not_found
+        it_behaves_like 'returning response status', :bad_request
       end
 
-      context 'when packages_protected_packages is disabled' do
+      context 'with already existing package_name_pattern' do
         before do
-          stub_feature_flags(packages_protected_packages: false)
+          other_package_protection_rule = create(:package_protection_rule, project: project,
+            package_name_pattern: "@my-scope/my-package-*")
+          params[:package_name_pattern] = other_package_protection_rule.package_name_pattern
         end
 
-        it_behaves_like 'returning response status', :not_found
+        it_behaves_like 'returning response status', :unprocessable_entity
       end
+
+      it_behaves_like 'rejecting project packages protection rules request when handling rule ids'
+      it_behaves_like 'rejecting project packages protection rules request when enough permissions'
+    end
+
+    context 'with invalid token' do
+      subject(:patch_package_rules) { patch(api(url), headers: headers_with_invalid_token, params: params) }
+
+      it_behaves_like 'returning response status', :unauthorized
     end
   end
 
@@ -175,44 +261,9 @@
         end.to raise_error(ActiveRecord::RecordNotFound)
         expect(response).to have_gitlab_http_status(:no_content)
       end
-    end
 
-    context 'when the package protection rule does belong to another project' do
-      let(:url) { "/projects/#{other_project.id}/packages/protection/rules/#{package_protection_rule.id}" }
-
-      it_behaves_like 'returning response status', :not_found
-    end
-
-    context 'when the project id is invalid' do
-      let(:url) { "/projects/invalid/packages/protection/rules/#{package_protection_rule.id}" }
-
-      it_behaves_like 'returning response status', :not_found
-    end
-
-    context 'when the project id does not exist' do
-      let(:url) { "/projects/#{non_existing_record_id}/packages/protection/rules/#{package_protection_rule.id}" }
-
-      it_behaves_like 'returning response status', :not_found
-    end
-
-    context 'when the rule id is invalid' do
-      let(:url) { "/projects/#{project.id}/packages/protection/rules/invalid" }
-
-      it_behaves_like 'returning response status', :bad_request
-    end
-
-    context 'when the rule id does not exist' do
-      let(:url) { "/projects/#{project.id}/packages/protection/rules/#{non_existing_record_id}" }
-
-      it_behaves_like 'returning response status', :not_found
-    end
-
-    context 'when packages_protected_packages is disabled' do
-      before do
-        stub_feature_flags(packages_protected_packages: false)
-      end
-
-      it_behaves_like 'returning response status', :not_found
+      it_behaves_like 'rejecting project packages protection rules request when handling rule ids'
+      it_behaves_like 'rejecting project packages protection rules request when enough permissions'
     end
 
     context 'with invalid token' do