diff --git a/storage-new/models/TokenLoginProcess.go b/storage-new/models/TokenLoginProcess.go
index ad96975..9bb67e7 100644
--- a/storage-new/models/TokenLoginProcess.go
+++ b/storage-new/models/TokenLoginProcess.go
@@ -4,9 +4,11 @@ import "time"
 
 // A token used during the login process
 // Each user may only have at most one login process active at the same time
+// Technically, that could be used to permanently block someone from logging in
+// by starting a new login process every time the target has just started one
 type LoginProcessToken struct {
 	User      User
-	UserId    string
+	UserId    string `gorm:"unique"`
 	Token     string `gorm:"primarykey;type:uuid;default:gen_random_uuid()"`
 	ExpiresAt time.Time
 }
diff --git a/storage-new/models/User.go b/storage-new/models/User.go
index 94ee0c8..409c28a 100644
--- a/storage-new/models/User.go
+++ b/storage-new/models/User.go
@@ -1,6 +1,7 @@
 package models
 
 import (
+	"database/sql"
 	"time"
 
 	"gorm.io/gorm"
@@ -50,17 +51,17 @@ type User struct {
 	Icon         MediaMetadata
 	IconId       string // ID of a media file used as icon
 	Background   *MediaMetadata
-	BackgroundId *string // ID of a media file used as background image
+	BackgroundId sql.NullString // ID of a media file used as background image
 	Banner       *MediaMetadata
-	BannerId     *string // ID of a media file used as banner
-	Indexable    bool    // Whether this account can be found by crawlers
-	PublicKey    []byte  // The public key of the account
+	BannerId     sql.NullString // ID of a media file used as banner
+	Indexable    bool           // Whether this account can be found by crawlers
+	PublicKey    []byte         // The public key of the account
 	// Whether this account restricts following
 	// If true, the owner must approve of a follow request first
 	RestrictedFollow bool
 
-	Location *string
-	Birthday *time.Time
+	Location sql.NullString
+	Birthday sql.NullTime
 
 	// Whether the account got verified and is allowed to be active
 	// For local accounts being active means being allowed to login and perform interactions