diff --git a/src/userdb.js b/src/userdb.js
index 921801011..19cd698f9 100644
--- a/src/userdb.js
+++ b/src/userdb.js
@@ -42,7 +42,9 @@ function postProcess(result) {
     result.twoFactorAuthenticationEnabled = !!result.twoFactorAuthenticationEnabled;
     result.active = !!result.active;
 
-    result.loginLocations = safe.JSON.parse(result.loginLocationsJson) || [];
+    // we have a locations property to not store top-level array
+    const loginLocations = safe.JSON.parse(result.loginLocationsJson) || {};
+    result.loginLocations = loginLocations.locations || [];
     delete result.loginLocationsJson;
 
     return result;
@@ -252,7 +254,7 @@ function update(userId, user, callback) {
             args.push(user[k] ? 1 : 0);
         } else if (k === 'loginLocations') {
             fields.push('loginLocationsJson = ?');
-            args.push(JSON.stringify({ loginLocations: user[k] }));
+            args.push(JSON.stringify({ locations: user[k] }));
         } else {
             fields.push(k + ' = ?');
             args.push(user[k]);