diff --git a/app/models/identity.rb b/app/models/identity.rb
index ee4a323b2..bb69734b4 100644
--- a/app/models/identity.rb
+++ b/app/models/identity.rb
@@ -8,7 +8,7 @@ class Identity < ApplicationRecord
 
   has_one_attached :avatar
 
-  before_destroy :deactivate_users
+  before_destroy :deactivate_users, prepend: true
 
   validates :email_address, format: { with: URI::MailTo::EMAIL_REGEXP }
   normalizes :email_address, with: ->(value) { value.strip.downcase.presence }
diff --git a/test/models/identity_test.rb b/test/models/identity_test.rb
index 1c6c6b258..5b5763ffd 100644
--- a/test/models/identity_test.rb
+++ b/test/models/identity_test.rb
@@ -46,4 +46,19 @@ class IdentityTest < ActiveSupport::TestCase
       assert_equal identity.email_address, user.name
     end
   end
+
+  test "destroy deactivates users before nullifying identity" do
+    identity = identities(:kevin)
+    user = users(:kevin)
+
+    assert_predicate user, :active?
+    assert_predicate user.accesses, :any?
+
+    identity.destroy!
+    user.reload
+
+    assert_nil user.identity_id, "identity should be nullified"
+    assert_not_predicate user, :active?
+    assert_empty user.accesses, "user accesses should be removed"
+  end
 end