diff --git a/changelog.d/2451.bugfix.3.md b/changelog.d/2451.bugfix.3.md
new file mode 100644
index 000000000..f75d21824
--- /dev/null
+++ b/changelog.d/2451.bugfix.3.md
@@ -0,0 +1 @@
+Appservices masquerading as a device that does not exist now receive 400 `M_UNKNOWN_DEVICE` as required by the spec, instead of 403 `M_FORBIDDEN`.
diff --git a/src/api/router/auth.rs b/src/api/router/auth.rs
index e731245df..af19fb03b 100644
--- a/src/api/router/auth.rs
+++ b/src/api/router/auth.rs
@@ -379,10 +379,7 @@ async fn check_access_token(
 				.await
 				.is_err()
 			{
-				return Err!(Request(Forbidden(
-					"Device does not exist for user or appservice cannot masquerade as this \
-					 device."
-				)));
+				return Err!(Request(UnknownDevice("Device does not exist for this user.")));
 			}
 
 			Some(device_id.to_owned())