diff --git a/crypto/machine.go b/crypto/machine.go
index c9c06c3b..8e9a6c66 100644
--- a/crypto/machine.go
+++ b/crypto/machine.go
@@ -638,6 +638,7 @@ func (mach *OlmMachine) HandleRoomKeyWithheld(ctx context.Context, content *even
 		zerolog.Ctx(ctx).Debug().Interface("content", content).Msg("Non-megolm room key withheld event")
 		return
 	}
+	// TODO log if there's a conflict? (currently ignored)
 	err := mach.CryptoStore.PutWithheldGroupSession(ctx, *content)
 	if err != nil {
 		zerolog.Ctx(ctx).Error().Err(err).Msg("Failed to save room key withheld event")
diff --git a/crypto/sql_store.go b/crypto/sql_store.go
index 26b4ddbe..0d824364 100644
--- a/crypto/sql_store.go
+++ b/crypto/sql_store.go
@@ -432,8 +432,11 @@ func (store *SQLCryptoStore) RedactOutdatedGroupSessions(ctx context.Context) ([
 }
 
 func (store *SQLCryptoStore) PutWithheldGroupSession(ctx context.Context, content event.RoomKeyWithheldEventContent) error {
-	_, err := store.DB.Exec(ctx, "INSERT INTO crypto_megolm_inbound_session (session_id, sender_key, room_id, withheld_code, withheld_reason, received_at, account_id) VALUES ($1, $2, $3, $4, $5, $6, $7)",
-		content.SessionID, content.SenderKey, content.RoomID, content.Code, content.Reason, time.Now().UTC(), store.AccountID)
+	_, err := store.DB.Exec(ctx, `
+		INSERT INTO crypto_megolm_inbound_session (session_id, sender_key, room_id, withheld_code, withheld_reason, received_at, account_id)
+		VALUES ($1, $2, $3, $4, $5, $6, $7)
+		ON CONFLICT (session_id, account_id) DO NOTHING
+	`, content.SessionID, content.SenderKey, content.RoomID, content.Code, content.Reason, time.Now().UTC(), store.AccountID)
 	return err
 }