diff --git a/binder/plugins/token_auth/middleware.py b/binder/plugins/token_auth/middleware.py
index 530b6125..0c6eb0c8 100644
--- a/binder/plugins/token_auth/middleware.py
+++ b/binder/plugins/token_auth/middleware.py
@@ -81,7 +81,7 @@ def __call__(self, request):
 			return self.get_response(request)
 
 		try:
-			token = Token.objects.get(token=token)
+			token = Token.objects.get(token=token, user__is_active=True)
 		except Token.DoesNotExist:
 			# Token does not exist
 			# Raise and catch needed to provide location
diff --git a/changelog/CRTX-969 b/changelog/CRTX-969
new file mode 100644
index 00000000..64f2c3b1
--- /dev/null
+++ b/changelog/CRTX-969
@@ -0,0 +1 @@
+- [CRTX-969] Fix issue where tokens for deleted users are still valid
diff --git a/tests/plugins/test_token_auth.py b/tests/plugins/test_token_auth.py
index f1ad5c16..4505a144 100644
--- a/tests/plugins/test_token_auth.py
+++ b/tests/plugins/test_token_auth.py
@@ -57,6 +57,14 @@ def test_token_expired(self):
 			EXTRA(): None,
 		})
 
+	def test_deactivated_user_token_auth(self):
+		# A deactivated user should not be able to authenticate with a token.
+		self.user.is_active = False
+		self.user.save()
+
+		res = self.client.get('/user/identify/')
+		self.assertEqual(res.status_code, 404)
+
 	def test_token_not_found(self):
 		old_token = self.token.token
 		self.token.token = 'foo'