diff --git a/src/main/java/com/l2/shots/auth/AuthResource.java b/src/main/java/com/l2/shots/auth/AuthResource.java
index afec130..efe5ad4 100644
--- a/src/main/java/com/l2/shots/auth/AuthResource.java
+++ b/src/main/java/com/l2/shots/auth/AuthResource.java
@@ -90,12 +90,17 @@ public class AuthResource {
         if (jwt.isEmpty()) return Response.status(401).build();
         Optional<User> user = authService.getEntityFromToken(jwt.get());
         if (user.isEmpty()) return Response.status(401).build();
+        User current = user.get();
         AuthService.ChangePasswordResult result = authService.changePassword(
-                user.get().id, body.currentPassword(), body.newPassword());
+                current.id, body.currentPassword(), body.newPassword());
         switch (result) {
             case OK:
-                User refreshed = User.findById(user.get().id);
+                // Refetch fresh desde DB porque la version cacheada en el
+                // persistence context tenia mustChangePassword=true (estado
+                // previo al cambio). Mejor un read fresco.
+                User refreshed = User.findById(current.id);
                 if (refreshed == null) return Response.status(401).build();
+                User.getEntityManager().refresh(refreshed);
                 String newToken = authService.buildToken(refreshed.id);
                 return Response.ok(AuthService.toAuthMe(refreshed))
                         .cookie(buildAuthCookie(newToken))