diff --git a/CHANGELOG.md b/CHANGELOG.md
index c2685305..a1d92290 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Bug Fixes
+
+* **event:** fix updating client access ([ee85e1d](https://github.com/the-luap/picpeak/commit/ee85e1d))
+
 ### Features
 
 * **i18n:** add French (fr) language support with full translation coverage
diff --git a/backend/src/routes/adminEvents.js b/backend/src/routes/adminEvents.js
index 556630d0..adcf5557 100644
--- a/backend/src/routes/adminEvents.js
+++ b/backend/src/routes/adminEvents.js
@@ -1192,14 +1192,6 @@ router.put('/:id', adminAuth, requirePermission('events.edit'), requireEventOwne
       return res.status(400).json({ error: 'external_path is required when source_mode is reference' });
     }
 
-    // Handle client access fields (#172)
-    if (Object.prototype.hasOwnProperty.call(updates, 'client_access_enabled')) {
-      updates.client_access_enabled = formatBoolean(updates.client_access_enabled);
-      // Auto-generate client share token when first enabling
-      if (parseBooleanInput(updates.client_access_enabled, false) && !event.client_share_token) {
-        updates.client_share_token = crypto.randomBytes(32).toString('hex');
-      }
-    }
     if (Object.prototype.hasOwnProperty.call(updates, 'client_password') && updates.client_password) {
       updates.client_password_hash = await bcrypt.hash(updates.client_password, getBcryptRounds());
       delete updates.client_password;
@@ -1281,6 +1273,15 @@ router.put('/:id', adminAuth, requirePermission('events.edit'), requireEventOwne
       }
     }
 
+    // Handle client access fields (#172)
+    if (Object.prototype.hasOwnProperty.call(updates, 'client_access_enabled')) {
+      updates.client_access_enabled = formatBoolean(updates.client_access_enabled);
+      // Auto-generate client share token when first enabling
+      if (parseBooleanInput(updates.client_access_enabled, false) && !event.client_share_token && !updates.client_share_token) {
+        updates.client_share_token = crypto.randomBytes(32).toString('hex');
+      }
+    }
+
     // Update event
     await db('events')
       .where('id', id)