diff --git a/webserver/api.go b/webserver/api.go
index 574045b..7b42b83 100644
--- a/webserver/api.go
+++ b/webserver/api.go
@@ -660,6 +660,10 @@ func tokensHandler(w http.ResponseWriter, r *http.Request, g, pth string) {
 			http.Error(w, "wrong group", http.StatusBadRequest)
 			return
 		}
+		if newtoken.Token != t {
+			http.Error(w, "token mismatch", http.StatusBadRequest)
+			return
+		}
 		_, err = token.Update(&newtoken, etag)
 		if err != nil {
 			httpError(w, err)
diff --git a/webserver/api_test.go b/webserver/api_test.go
index ceb5c02..352a9a9 100644
--- a/webserver/api_test.go
+++ b/webserver/api_test.go
@@ -323,6 +323,13 @@ func TestApi(t *testing.T) {
 		t.Errorf("Update token: %v %v", err, resp.StatusCode)
 	}
 
+	tok.Token = "badtoken"
+	resp, err = do("PUT", tokenpath,
+		"application/json", "", "", marshalToString(tok))
+	if err != nil || resp.StatusCode != http.StatusBadRequest {
+		t.Errorf("Update mismatched token: %v %v", err, resp.StatusCode)
+	}
+
 	tok.Group = "bad"
 	resp, err = do("PUT", tokenpath,
 		"application/json", "", "", marshalToString(tok))