diff --git a/internal/api/external.go b/internal/api/external.go
index 14bdfe087b..8ed87ff9d6 100644
--- a/internal/api/external.go
+++ b/internal/api/external.go
@@ -182,7 +182,7 @@ func (a *API) internalExternalProviderCallback(w http.ResponseWriter, r *http.Re
 	userData := data.userData
 
 	if len(userData.Emails) == 0 && !emailOptional {
-		return apierrors.NewInternalServerError("Error getting user email from external provider")
+		return apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeEmailAddressNotProvided, "Error getting user email from external provider")
 	}
 
 	userData.Metadata.EmailVerified = false
@@ -384,7 +384,9 @@ func (a *API) createAccountFromExternalIdentity(tx *storage.Connection, r *http.
 		user = decision.User
 		identity = decision.Identities[0]
 
+		now := time.Now()
 		identity.IdentityData = identityData
+		identity.LastSignInAt = &now
 		if terr = tx.UpdateOnly(identity, "identity_data", "last_sign_in_at"); terr != nil {
 			return 0, nil, terr
 		}
diff --git a/internal/api/mail.go b/internal/api/mail.go
index 9a42651c42..39c2af64dc 100644
--- a/internal/api/mail.go
+++ b/internal/api/mail.go
@@ -258,7 +258,8 @@ func (a *API) adminGenerateLink(w http.ResponseWriter, r *http.Request) error {
 			if params.Type == "email_change_current" {
 				user.EmailChangeTokenCurrent = hashedToken
 			} else if params.Type == "email_change_new" {
-				user.EmailChangeTokenNew = crypto.GenerateTokenHash(params.NewEmail, otp)
+				hashedToken = crypto.GenerateTokenHash(params.NewEmail, otp)
+				user.EmailChangeTokenNew = hashedToken
 			}
 			terr = tx.UpdateOnly(user, "email_change_token_current", "email_change_token_new", "email_change", "email_change_sent_at", "email_change_confirm_status")
 			if terr != nil {
@@ -838,7 +839,7 @@ func (a *API) sendEmail(r *http.Request, tx *storage.Connection, u *models.User,
 			Token:           otp,
 			EmailActionType: params.emailActionType,
 			RedirectTo:      referrerURL,
-			SiteURL:         externalURL.String(),
+			SiteURL:         config.SiteURL,
 			TokenHash:       params.tokenHashWithPrefix,
 		}
 		if params.emailActionType == mail.EmailChangeVerification {