diff --git a/sync2/devices_table.go b/sync2/devices_table.go
index ab6ddb9..30e68df 100644
--- a/sync2/devices_table.go
+++ b/sync2/devices_table.go
@@ -32,8 +32,8 @@ func NewDevicesTable(db *sqlx.DB) *DevicesTable {
 
 // InsertDevice creates a new devices row with a blank since token if no such row
 // exists. Otherwise, it does nothing.
-func (t *DevicesTable) InsertDevice(userID, deviceID string) error {
-	_, err := t.db.Exec(
+func (t *DevicesTable) InsertDevice(txn *sqlx.Tx, userID, deviceID string) error {
+	_, err := txn.Exec(
 		` INSERT INTO syncv3_sync2_devices(user_id, device_id, since) VALUES($1,$2,$3)
 		ON CONFLICT (user_id, device_id) DO NOTHING`,
 		userID, deviceID, "",
diff --git a/sync2/tokens_table.go b/sync2/tokens_table.go
index 066c650..961e7bd 100644
--- a/sync2/tokens_table.go
+++ b/sync2/tokens_table.go
@@ -171,10 +171,10 @@ func (t *TokensTable) TokenForEachDevice(txn *sqlx.Tx) (tokens []TokenForPoller,
 }
 
 // Insert a new token into the table.
-func (t *TokensTable) Insert(plaintextToken, userID, deviceID string, lastSeen time.Time) (*Token, error) {
+func (t *TokensTable) Insert(txn *sqlx.Tx, plaintextToken, userID, deviceID string, lastSeen time.Time) (*Token, error) {
 	hashedToken := hashToken(plaintextToken)
 	encToken := t.encrypt(plaintextToken)
-	_, err := t.db.Exec(
+	_, err := txn.Exec(
 		`INSERT INTO syncv3_sync2_tokens(token_hash, token_encrypted, user_id, device_id, last_seen)
 		VALUES ($1, $2, $3, $4, $5)
 		ON CONFLICT (token_hash) DO NOTHING;`,
diff --git a/sync3/handler/handler.go b/sync3/handler/handler.go
index 0f2c100..98d4e61 100644
--- a/sync3/handler/handler.go
+++ b/sync3/handler/handler.go
@@ -420,14 +420,14 @@ func (h *SyncLiveHandler) identifyUnknownAccessToken(accessToken string, logger
 	var token *sync2.Token
 	err = sqlutil.WithTransaction(h.V2Store.DB, func(txn *sqlx.Tx) error {
 		// Create a brand-new row for this token.
-		token, err = h.V2Store.TokensTable.Insert(accessToken, userID, deviceID, time.Now())
+		token, err = h.V2Store.TokensTable.Insert(txn, accessToken, userID, deviceID, time.Now())
 		if err != nil {
 			logger.Warn().Err(err).Str("user", userID).Str("device", deviceID).Msg("failed to insert v2 token")
 			return err
 		}
 
 		// Ensure we have a device row for this token.
-		err = h.V2Store.DevicesTable.InsertDevice(userID, deviceID)
+		err = h.V2Store.DevicesTable.InsertDevice(txn, userID, deviceID)
 		if err != nil {
 			log.Warn().Err(err).Str("user", userID).Str("device", deviceID).Msg("failed to insert v2 device")
 			return err