diff --git a/src/app/api/2fa/setup/confirm/route.ts b/src/app/api/2fa/setup/confirm/route.ts
index 93138f46b..1e262d065 100644
--- a/src/app/api/2fa/setup/confirm/route.ts
+++ b/src/app/api/2fa/setup/confirm/route.ts
@@ -69,9 +69,9 @@ export async function POST(request: Request) {
     await tx.twoFactorBackupCode.createMany({
       data: hashed.map(codeHash => ({ userId, codeHash })),
     });
+    await markOtpUsed(userId, token, tx);
   });
 
-  await markOtpUsed(userId, token);
   await resetRateLimit(userId);
 
   return json({ backupCodes: plaintext });