diff --git a/src/backend/tokens.rs b/src/backend/tokens.rs
index f660164..a897a70 100644
--- a/src/backend/tokens.rs
+++ b/src/backend/tokens.rs
@@ -19,7 +19,7 @@ impl Backend {
     ) -> anyhow::Result<anyhow::Result<Uuid, Error>> {
         match sqlx::query_as!(
             AuthTokensRow,
-            r#"SELECT * FROM AuthTokens WHERE token = ?;"#,
+            r#"SELECT * FROM AuthTokens WHERE token = ? LIMIT 1;"#,
             token
         )
         .fetch_one(&self.pool)
@@ -49,7 +49,7 @@ impl Backend {
     ) -> anyhow::Result<anyhow::Result<(), Error>> {
         match sqlx::query_as!(
             InviteTokensRow,
-            r#"SELECT * FROM InviteTokens WHERE token = ?;"#,
+            r#"SELECT * FROM InviteTokens WHERE token = ? LIMIT 1;"#,
             token
         )
         .fetch_one(&self.pool)
diff --git a/src/backend/user.rs b/src/backend/user.rs
index 48e4b7c..a9160d0 100644
--- a/src/backend/user.rs
+++ b/src/backend/user.rs
@@ -90,7 +90,7 @@ impl Backend {
     async fn get_user(&self, userid: Uuid) -> Result<Result<User, Error>> {
         match sqlx::query_as!(
             UsersRow,
-            r#"SELECT * FROM Users WHERE userid = ?;"#,
+            r#"SELECT * FROM Users WHERE userid = ? LIMIT 1;"#,
             userid.as_bytes().as_slice()
         )
         .fetch_one(&self.pool)