diff --git a/apps/dashboard/src/routes/invite/t/[hash]/+page.svelte b/apps/dashboard/src/routes/invite/t/[hash]/+page.svelte
index b03dc57e..195feb0a 100644
--- a/apps/dashboard/src/routes/invite/t/[hash]/+page.svelte
+++ b/apps/dashboard/src/routes/invite/t/[hash]/+page.svelte
@@ -89,19 +89,8 @@
         throw 'Unable to create profile';
       }
 
-      // Update member response
-      const updateMemberRes = await supabase
-        .from('organizationmember')
-        .update({
-          verified: true,
-          profile_id: profile.id
-        })
-        .match({ email: data.invite.email, organization_id: data.invite.currentOrg?.id });
-
-      console.log('Update member response', updateMemberRes);
-
       const res = await supabase.auth.signInWithPassword({
-        email: data.invite.email,
+        email: profile.email,
         password: fields.password
       });
 
@@ -109,9 +98,19 @@
         throw res.error;
       }
 
+      // Update member response
+      const updateMemberRes = await supabase
+        .from('organizationmember')
+        .update({
+          verified: true,
+          profile_id: profile.id
+        })
+        .match({ email: profile.email, organization_id: data.invite.currentOrg?.id });
+
+      console.log('Update member response', updateMemberRes);
+
       formRef?.reset();
 
-      console.log({ path: $currentOrgPath });
       return goto($currentOrgPath);
     } catch (error) {
       if (error instanceof Error) {
diff --git a/supabase/migrations/20240717053936_rls.sql b/supabase/migrations/20240717053936_rls.sql
index b49ebef2..b4e7e0c3 100644
--- a/supabase/migrations/20240717053936_rls.sql
+++ b/supabase/migrations/20240717053936_rls.sql
@@ -1060,6 +1060,16 @@ to public
 using (is_org_admin())
 with check (is_org_admin());
 
+create policy "Only user can update their account via email"
+on "public"."organizationmember"
+as PERMISSIVE
+for UPDATE
+to public
+using (
+  (select auth.jwt()) ->> 'email' = email
+with check (
+  (select auth.jwt()) ->> 'email' = email
+);
 
 create policy "Only auth users can read profile"
 on "public"."profile"