diff --git a/app/Livewire/Auth/Login.php b/app/Livewire/Auth/Login.php
index 929f298..1088f2b 100644
--- a/app/Livewire/Auth/Login.php
+++ b/app/Livewire/Auth/Login.php
@@ -66,13 +66,14 @@ class Login extends Component
             RateLimiter::hit($pairKey, 60);   // 5 / minute
             RateLimiter::hit($ipKey, 60);     // 20 / minute
             RateLimiter::hit($acctKey, 900);  // 30 / 15 minutes
-            app(BruteforceGuard::class)->record(request()->ip(), 'login');
+            $ip = request()->ip();
+            app(BruteforceGuard::class)->record($ip, 'login');
             AuditEvent::create([
                 'user_id' => null,
                 'actor' => 'system',
                 'action' => 'auth.login_failed',
                 'target' => $this->email,
-                'ip' => request()->ip(),
+                'ip' => $ip,
             ]);
             throw ValidationException::withMessages(['email' => __('auth.invalid_credentials')]);
         }
diff --git a/tests/Feature/BruteforceHooksTest.php b/tests/Feature/BruteforceHooksTest.php
index 97b6a5b..591a768 100644
--- a/tests/Feature/BruteforceHooksTest.php
+++ b/tests/Feature/BruteforceHooksTest.php
@@ -81,5 +81,6 @@ class BruteforceHooksTest extends TestCase
         }
 
         $this->assertDatabaseHas('banned_ips', ['ip' => '203.0.113.6', 'reason' => '2fa']);
+        $this->assertDatabaseHas('audit_events', ['action' => 'auth.2fa_failed']);
     }
 }