diff --git a/server/config/passport.js b/server/config/passport.js
index 5a4547c0b4..3d925e57e0 100644
--- a/server/config/passport.js
+++ b/server/config/passport.js
@@ -54,6 +54,9 @@ passport.use(
         const isMatch = await user.comparePassword(password);
 
         if (isMatch) {
+          user.lastLoginTimestamp = Date.now();
+          await user.save();
+
           return done(null, user);
         } else { // eslint-disable-line
           return done(null, false, { msg: 'Invalid email or password' });
@@ -88,6 +91,8 @@ passport.use(
       }
 
       keyDocument.lastUsedAt = Date.now();
+      user.lastLoginTimestamp = Date.now();
+
       await user.save();
       return done(null, user);
     } catch (err) {
@@ -140,6 +145,9 @@ passport.use(
           } else if (existingUser.banned) {
             return done(null, false, { msg: accountSuspensionMessage });
           }
+          existingUser.lastLoginTimestamp = Date.now();
+          await existingUser.save();
+
           return done(null, existingUser);
         }
 
@@ -239,6 +247,9 @@ passport.use(
           } else if (existingUser.banned) {
             return done(null, false, { msg: accountSuspensionMessage });
           }
+          existingUser.lastLoginTimestamp = Date.now();
+          await existingUser.save();
+
           return done(null, existingUser);
         }
 
diff --git a/server/models/user.js b/server/models/user.js
index 2090cab568..b825971747 100644
--- a/server/models/user.js
+++ b/server/models/user.js
@@ -82,7 +82,8 @@ const userSchema = new Schema(
       enum: ['none', 'essential', 'all'],
       default: 'none'
     },
-    banned: { type: Boolean, default: false }
+    banned: { type: Boolean, default: false },
+    lastLoginTimestamp: { type: Date }
   },
   { timestamps: true, usePushEach: true }
 );
diff --git a/server/server.js b/server/server.js
index 8b4d196451..1e9aa6ed6a 100644
--- a/server/server.js
+++ b/server/server.js
@@ -94,7 +94,8 @@ app.use(
     name: 'sessionId',
     cookie: {
       httpOnly: true,
-      secure: false
+      secure: false,
+      maxAge: 1000 * 60 * 60 * 24 * 28 // 4 weeks in milliseconds
     },
     store: new MongoStore({
       clientPromise,