diff --git a/core/players.go b/core/players.go
index 963914514..b757f8460 100644
--- a/core/players.go
+++ b/core/players.go
@@ -38,7 +38,7 @@ func (p *players) Register(ctx context.Context, playerID, client, userAgent, ip
 	user, _ := request.UserFrom(ctx)
 	if playerID != "" {
 		plr, err = p.ds.Player(ctx).Get(playerID)
-		if err == nil && plr.Client != client {
+		if err == nil && (plr.Client != client || plr.UserId != user.ID) {
 			playerID = ""
 		}
 	}
diff --git a/core/players_test.go b/core/players_test.go
index 90c265fcc..55ec16833 100644
--- a/core/players_test.go
+++ b/core/players_test.go
@@ -61,8 +61,19 @@ var _ = Describe("Players", func() {
 			Expect(trc).To(BeNil())
 		})
 
+		It("does not reuse another user's player by ID", func() {
+			plr := &model.Player{ID: "123", Name: "A Player", Client: "client", UserId: "otheruser", UserAgent: "Pixel", TranscodingId: "1"}
+			repo.add(plr)
+			p, trc, err := players.Register(ctx, "123", "client", "chrome", "1.2.3.4")
+			Expect(err).ToNot(HaveOccurred())
+			Expect(p.ID).ToNot(Equal("123"))
+			Expect(p.UserId).To(Equal("userid"))
+			Expect(repo.lastSaved).To(Equal(p))
+			Expect(trc).To(BeNil())
+		})
+
 		It("finds players by ID", func() {
-			plr := &model.Player{ID: "123", Name: "A Player", Client: "client", LastSeen: time.Time{}}
+			plr := &model.Player{ID: "123", Name: "A Player", Client: "client", UserId: "userid", LastSeen: time.Time{}}
 			repo.add(plr)
 			p, trc, err := players.Register(ctx, "123", "client", "chrome", "1.2.3.4")
 			Expect(err).ToNot(HaveOccurred())
@@ -93,7 +104,7 @@ var _ = Describe("Players", func() {
 		})
 
 		It("finds player by ID and return its transcoding", func() {
-			plr := &model.Player{ID: "123", Name: "A Player", Client: "client", LastSeen: time.Time{}, TranscodingId: "1"}
+			plr := &model.Player{ID: "123", Name: "A Player", Client: "client", UserId: "userid", LastSeen: time.Time{}, TranscodingId: "1"}
 			repo.add(plr)
 			p, trc, err := players.Register(ctx, "123", "client", "chrome", "1.2.3.4")
 			Expect(err).ToNot(HaveOccurred())
diff --git a/persistence/player_repository.go b/persistence/player_repository.go
index a2b079d53..a2114b060 100644
--- a/persistence/player_repository.go
+++ b/persistence/player_repository.go
@@ -126,7 +126,7 @@ func (r *playerRepository) Save(entity any) (string, error) {
 	if !r.isPermitted(t) {
 		return "", rest.ErrPermissionDenied
 	}
-	return r.put(t.ID, t)
+	return r.put("", t) // Save only creates; edits go through the owner-scoped Update
 }
 
 func (r *playerRepository) Update(id string, entity any, cols ...string) error {
diff --git a/persistence/player_repository_test.go b/persistence/player_repository_test.go
index b7085a1fb..4a7701ac2 100644
--- a/persistence/player_repository_test.go
+++ b/persistence/player_repository_test.go
@@ -288,6 +288,27 @@ var _ = Describe("PlayerRepository", func() {
 			Expect(*stored).To(Equal(adminPlayer1))
 		})
 
+		It("does not let a regular user overwrite another user's player via Save with a spoofed id", func() {
+			spoofed := model.Player{
+				ID:             adminPlayer1.ID,
+				Name:           "HIJACKED",
+				UserId:         regularUser.ID,
+				ReportRealPath: true,
+			}
+
+			id, err := regularRepo.Save(&spoofed)
+			Expect(err).To(BeNil())
+			Expect(id).ToNot(Equal(adminPlayer1.ID))
+
+			stored, err := adminRepo.Get(adminPlayer1.ID)
+			Expect(err).To(BeNil())
+			Expect(*stored).To(Equal(adminPlayer1))
+
+			created, err := adminRepo.Get(id)
+			Expect(err).To(BeNil())
+			Expect(created.UserId).To(Equal(regularUser.ID))
+		})
+
 		It("does not let a regular user reassign their own player to another user", func() {
 			// Owner updates their own player but tries to give it away to the admin. The update
 			// succeeds for the other fields, but user_id is never written, so ownership stays put.