diff --git a/api4/user_test.go b/api4/user_test.go
index 905b12b12c..3dd34abbc0 100644
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -4,6 +4,7 @@
 package api4
 
 import (
+	"fmt"
 	"net/http"
 	"strconv"
 	"strings"
@@ -2030,24 +2031,24 @@ func TestUserLoginMFAFlow(t *testing.T) {
 		*c.ServiceSettings.EnableMultifactorAuthentication = true
 	})
 
-	secret, err := th.App.GenerateMfaSecret(th.BasicUser.Id)
-	assert.Nil(t, err)
-
 	t.Run("WithoutMFA", func(t *testing.T) {
 		_, resp := th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
 		CheckNoError(t, resp)
 	})
 
-	// Fake user has MFA enabled
-	if result := <-th.Server.Store.User().UpdateMfaActive(th.BasicUser.Id, true); result.Err != nil {
-		t.Fatal(result.Err)
-	}
-
-	if result := <-th.Server.Store.User().UpdateMfaSecret(th.BasicUser.Id, secret.Secret); result.Err != nil {
-		t.Fatal(result.Err)
-	}
-
 	t.Run("WithInvalidMFA", func(t *testing.T) {
+		secret, err := th.App.GenerateMfaSecret(th.BasicUser.Id)
+		assert.Nil(t, err)
+
+		// Fake user has MFA enabled
+		if result := <-th.Server.Store.User().UpdateMfaActive(th.BasicUser.Id, true); result.Err != nil {
+			t.Fatal(result.Err)
+		}
+
+		if result := <-th.Server.Store.User().UpdateMfaSecret(th.BasicUser.Id, secret.Secret); result.Err != nil {
+			t.Fatal(result.Err)
+		}
+
 		user, resp := th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
 		CheckErrorMessage(t, resp, "mfa.validate_token.authenticate.app_error")
 		assert.Nil(t, user)
@@ -2068,10 +2069,21 @@ func TestUserLoginMFAFlow(t *testing.T) {
 	})
 
 	t.Run("WithCorrectMFA", func(t *testing.T) {
-		t.Skip("Skipping test that fails randomly.")
+		secret, err := th.App.GenerateMfaSecret(th.BasicUser.Id)
+		assert.Nil(t, err)
+
+		// Fake user has MFA enabled
+		if result := <-th.Server.Store.User().UpdateMfaActive(th.BasicUser.Id, true); result.Err != nil {
+			t.Fatal(result.Err)
+		}
+
+		if result := <-th.Server.Store.User().UpdateMfaSecret(th.BasicUser.Id, secret.Secret); result.Err != nil {
+			t.Fatal(result.Err)
+		}
+
 		code := dgoogauth.ComputeCode(secret.Secret, time.Now().UTC().Unix()/30)
 
-		user, resp := th.Client.LoginWithMFA(th.BasicUser.Email, th.BasicUser.Password, strconv.Itoa(code))
+		user, resp := th.Client.LoginWithMFA(th.BasicUser.Email, th.BasicUser.Password, fmt.Sprintf("%06d", code))
 		CheckNoError(t, resp)
 		assert.NotNil(t, user)
 	})