diff --git a/src/api/client/session.rs b/src/api/client/session.rs
index 881b740f5..10f67b6a5 100644
--- a/src/api/client/session.rs
+++ b/src/api/client/session.rs
@@ -87,6 +87,10 @@ pub(crate) async fn handle_login(
 		return Err!(Request(InvalidParam("User ID does not belong to this homeserver")));
 	}
 
+	if services.users.is_deactivated(&user_id).await? {
+		return Err!(Request(UserDeactivated("This account has been deactivated.")));
+	}
+
 	if services.users.is_locked(&user_id).await? {
 		return Err!(Request(UserLocked("This account has been locked.")));
 	}
diff --git a/src/api/router/auth.rs b/src/api/router/auth.rs
index ed3dcec42..1fded1350 100644
--- a/src/api/router/auth.rs
+++ b/src/api/router/auth.rs
@@ -162,6 +162,9 @@ impl CheckAuth for AccessToken {
 		query: AuthQueryParams,
 		route: TypeId,
 	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
 		if let Ok((sender_user, sender_device)) = services.users.find_from_token(&output).await {
 			// Locked users can only use /logout and /logout/all
 			if services
@@ -259,6 +262,9 @@ impl CheckAuth for AppserviceToken {
 		_query: AuthQueryParams,
 		_route: TypeId,
 	) -> Result<Self::Identity> {
+		if output.is_empty() {
+			return Err!(Request(Unauthorized("Missing access token.")));
+		}
 		let Ok(appservice_info) = services.appservice.find_from_token(&output).await else {
 			return Err!(Request(Unauthorized("Invalid appservice token.")));
 		};
diff --git a/src/service/users/mod.rs b/src/service/users/mod.rs
index 1948fbf08..4dafb39f9 100644
--- a/src/service/users/mod.rs
+++ b/src/service/users/mod.rs
@@ -338,6 +338,7 @@ impl Service {
 
 	/// Find out which user an access token belongs to.
 	pub async fn find_from_token(&self, token: &str) -> Result<(OwnedUserId, OwnedDeviceId)> {
+		assert!(!token.is_empty(), "Empty access token");
 		self.db.token_userdeviceid.get(token).await.deserialized()
 	}