diff --git a/browserid/lib/db_mysql.js b/browserid/lib/db_mysql.js
index 8392d359737c0746f84d3b5db322ed40c83f35ed..93fc3a7ce46a2bfafd28faeaea2800baf8b43b7d 100644
--- a/browserid/lib/db_mysql.js
+++ b/browserid/lib/db_mysql.js
@@ -323,7 +323,7 @@ exports.stageEmail = function(existing_email, new_email, cb) {
   // overwrite previously staged users
   client.query('INSERT INTO staged (secret, new_acct, existing, email) VALUES(?,FALSE,?,?) ' +
                'ON DUPLICATE KEY UPDATE secret=?, existing=?, new_acct=FALSE, passwd=""',
-               [ secret, existing_email, new_email, pubkey, secret, existing_email, pubkey],
+               [ secret, existing_email, new_email, secret, existing_email],
                function(err) {
                  if (err) {
                    logUnexpectedError(err);