diff --git a/test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js b/test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js
index 4e6f4dad7c..d5f5d88c15 100644
--- a/test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js
+++ b/test/api/v3/integration/challenges/PUT-challenges_challengeId.test.js
@@ -56,11 +56,11 @@ describe('PUT /challenges/:challengeId', () => {
       tasksOrder: 'new order',
       official: true,
       shortName: 'new short name',
+      leader: member._id,
 
       // applied
       name: 'New Challenge Name',
       description: 'New challenge description.',
-      leader: member._id,
     });
 
     expect(res.prize).to.equal(0);
@@ -76,12 +76,12 @@ describe('PUT /challenges/:challengeId', () => {
     expect(res.shortName).not.to.equal('new short name');
 
     expect(res.leader).to.eql({
-      _id: member._id,
-      id: member._id,
-      profile: {name: member.profile.name},
+      _id: user._id,
+      id: user._id,
+      profile: {name: user.profile.name},
       auth: {
         local: {
-          username: member.auth.local.username,
+          username: user.auth.local.username,
         },
       },
       flags: {
diff --git a/website/server/models/challenge.js b/website/server/models/challenge.js
index 492b0592dd..62ab8716a0 100644
--- a/website/server/models/challenge.js
+++ b/website/server/models/challenge.js
@@ -62,7 +62,7 @@ schema.pre('init', function ensureSummaryIsFetched (chal) {
 });
 
 // A list of additional fields that cannot be updated (but can be set on creation)
-let noUpdate = ['group', 'official', 'shortName', 'prize'];
+let noUpdate = ['group', 'leader', 'official', 'shortName', 'prize'];
 schema.statics.sanitizeUpdate = function sanitizeUpdate (updateObj) {
   return this.sanitize(updateObj, noUpdate);
 };