diff --git a/backend/app/tg/login_flow.py b/backend/app/tg/login_flow.py
index d709389..d066e09 100644
--- a/backend/app/tg/login_flow.py
+++ b/backend/app/tg/login_flow.py
@@ -79,7 +79,9 @@
         raise DomainError(422, "invalid phone number (E.164, e.g. +15551234567)") from exc
 
     cursor = await db.execute(
-        "SELECT COUNT(*) AS n FROM login_sessions WHERE user_id = ?", (owner_user_id,)
+        "SELECT COUNT(*) AS n FROM login_sessions"
+        " WHERE user_id = ? AND expires_at > ?",
+        (owner_user_id, _now().isoformat()),
     )
     if (await cursor.fetchone())["n"] >= 3:
         raise DomainError(409, "too many pending logins (max 3) — cancel or wait for expiry")
@@ -324,7 +326,9 @@
     manager = _manager()
     db = get_db()
     cursor = await db.execute(
-        "SELECT COUNT(*) AS n FROM login_sessions WHERE user_id = ?", (owner_user_id,)
+        "SELECT COUNT(*) AS n FROM login_sessions"
+        " WHERE user_id = ? AND expires_at > ?",
+        (owner_user_id, _now().isoformat()),
     )
     if (await cursor.fetchone())["n"] >= 3:
         raise DomainError(409, "too many pending logins (max 3) — cancel or wait for expiry")