diff --git a/app/controllers/devise/password_expired_controller.rb b/app/controllers/devise/password_expired_controller.rb
index <HASH>..<HASH> 100644
--- a/app/controllers/devise/password_expired_controller.rb
+++ b/app/controllers/devise/password_expired_controller.rb
@@ -15,6 +15,7 @@ class Devise::PasswordExpiredController < ApplicationController
     if resource.update_with_password(params[resource_name])
       warden.session(scope)[:password_expired] = false
       set_flash_message :notice, :updated
+      sign_in scope, resource, :bypass => true
       redirect_to stored_location_for(scope) || :root
     else
       clean_up_passwords(resource)
after password update on expire, the user must not login again.