diff --git a/src/users.js b/src/users.js
index 4288831d0..430bbee50 100644
--- a/src/users.js
+++ b/src/users.js
@@ -480,9 +480,10 @@ function resetPasswordByIdentifier(identifier, callback) {
     getter(identifier.toLowerCase(), function (error, result) {
         if (error) return callback(error);
 
-        result.resetToken = hat(256);
+        let resetToken = hat(256);
+        result.resetToken = resetToken;
 
-        userdb.update(result.id, result, function (error) {
+        userdb.update(result.id, { resetToken }, function (error) {
             if (error) return callback(error);
 
             mailer.passwordReset(result);