diff --git a/enrol/lti/classes/tool_provider.php b/enrol/lti/classes/tool_provider.php
index 0e181acd7ac..ab5ed85fe91 100644
--- a/enrol/lti/classes/tool_provider.php
+++ b/enrol/lti/classes/tool_provider.php
@@ -354,7 +354,7 @@ class tool_provider extends ToolProvider {
             $userlog->serviceurl = $serviceurl;
             $userlog->sourceid = $sourceid;
             $userlog->consumerkey = $this->consumer->getKey();
-            $userlog->consumersecret = $tool->secret;
+            $userlog->consumersecret = $this->consumer->secret;
             $userlog->lastgrade = 0;
             $userlog->lastaccess = time();
             $userlog->timecreated = time();
diff --git a/enrol/lti/db/upgrade.php b/enrol/lti/db/upgrade.php
index e67e5329aeb..12899b4b65c 100644
--- a/enrol/lti/db/upgrade.php
+++ b/enrol/lti/db/upgrade.php
@@ -69,5 +69,26 @@ function xmldb_enrol_lti_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2021051701, 'enrol', 'lti');
     }
 
+    if ($oldversion < 2021051702) {
+        // Update lti user information for LTI 2.0 users having the wrong consumer secret recorded.
+        // This applies to any LTI 2.0 user who has launched the tool (i.e. has lastaccess) and fixes a non-functional grade sync
+        // for LTI 2.0 consumers.
+        $sql = "SELECT lu.id, lc.secret
+                  FROM {enrol_lti_users} lu
+                  JOIN {enrol_lti_lti2_consumer} lc
+                    ON (lu.consumerkey = lc.consumerkey256)
+                 WHERE lc.ltiversion = :ltiversion
+                   AND lu.consumersecret != lc.secret
+                   AND lu.lastaccess IS NOT NULL";
+        $affectedltiusersrs = $DB->get_recordset_sql($sql, ['ltiversion' => 'LTI-2p0']);
+        foreach ($affectedltiusersrs as $ltiuser) {
+            $DB->set_field('enrol_lti_users', 'consumersecret', $ltiuser->secret, ['id' => $ltiuser->id]);
+        }
+        $affectedltiusersrs->close();
+
+        // Lti savepoint reached.
+        upgrade_plugin_savepoint(true, 2021051702, 'enrol', 'lti');
+    }
+
     return true;
 }
diff --git a/enrol/lti/version.php b/enrol/lti/version.php
index 4263f277d26..d9eb0038c6d 100644
--- a/enrol/lti/version.php
+++ b/enrol/lti/version.php
@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2021051701; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2021051702; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2021051100; // Requires this Moodle version.
 $plugin->component = 'enrol_lti'; // Full name of the plugin (used for diagnostics).