diff --git a/src/c3nav/control/views/users.py b/src/c3nav/control/views/users.py
index 3e8e5731..9da469ae 100644
--- a/src/c3nav/control/views/users.py
+++ b/src/c3nav/control/views/users.py
@@ -103,7 +103,9 @@ def user_detail(request, user):  # todo: make class based view
         if request.method == 'POST' and request.POST.get('submit_access_permissions'):
             form = AccessPermissionForm(request=request, data=request.POST)
             if form.is_valid():
-                form.get_token().redeem(user)
+                token = form.get_token()
+                token.save()
+                token.redeem(user)
                 messages.success(request, _('Access permissions successfully granted.'))
                 return redirect(request.path_info)
         else: