diff --git a/app/controllers/mfa_setup_controller.rb b/app/controllers/mfa_setup_controller.rb
index 702bd6e9b..48ae6d5dc 100644
--- a/app/controllers/mfa_setup_controller.rb
+++ b/app/controllers/mfa_setup_controller.rb
@@ -33,7 +33,7 @@ class MfaSetupController < ApplicationController
   def destroy
     RateLimit.call("mfa-setup-otp-#{current_user.id}", limit: 5, ttl: 5.minutes, enabled: true)
 
-    if current_user.validate_and_consume_otp!(params[:otp_attempt])
+    if current_user.valid_for_authentication? { current_user.validate_and_consume_otp!(params[:otp_attempt]) }
       current_user.update!(otp_required_for_login: false, otp_secret: nil)
 
       redirect_to settings_profile_index_path, notice: I18n.t('2fa_has_been_removed')
diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb
index efa97448c..8c60470db 100644
--- a/config/initializers/devise.rb
+++ b/config/initializers/devise.rb
@@ -235,10 +235,10 @@ Devise.setup do |config|
 
   # Number of authentication tries before locking an account if lock_strategy
   # is failed attempts.
-  # config.maximum_attempts = 20
+  config.maximum_attempts = 15
 
   # Time interval to unlock the account if :time is enabled as unlock_strategy.
-  # config.unlock_in = 1.hour
+  config.unlock_in = 23.hours
 
   # Warn on the last attempt before the account is locked.
   # config.last_attempt_warning = true