diff --git a/files/routes/settings.py b/files/routes/settings.py
index d16af09e1e..64e68b1279 100644
--- a/files/routes/settings.py
+++ b/files/routes/settings.py
@@ -462,6 +462,7 @@ def settings_security_post(v):
 
 		v.mfa_secret = None
 		g.db.add(v)
+		g.db.commit()
 		return render_template("settings/security.html", v=v, msg="Two-factor authentication disabled.")
 
 @app.post("/settings/log_out_all_others")