diff --git a/enrol/lti/classes/tool_provider.php b/enrol/lti/classes/tool_provider.php
index ab5ed85fe91..ad96103cb1b 100644
--- a/enrol/lti/classes/tool_provider.php
+++ b/enrol/lti/classes/tool_provider.php
@@ -344,6 +344,9 @@ class tool_provider extends ToolProvider {
             if ($userlog->serviceurl != $serviceurl) {
                 $userlog->serviceurl = $serviceurl;
             }
+            if (empty($userlog->consumersecret)) {
+                $userlog->consumersecret = $this->consumer->secret;
+            }
             $userlog->lastaccess = time();
             $DB->update_record('enrol_lti_users', $userlog);
         } else {
diff --git a/enrol/lti/db/upgrade.php b/enrol/lti/db/upgrade.php
index 12899b4b65c..396ad92d8f1 100644
--- a/enrol/lti/db/upgrade.php
+++ b/enrol/lti/db/upgrade.php
@@ -90,5 +90,26 @@ function xmldb_enrol_lti_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2021051702, 'enrol', 'lti');
     }
 
+    if ($oldversion < 2021051703) {
+        // Update lti user information for any users missing a consumer secret.
+        // This applies to any user who has launched the tool (i.e. has lastaccess) but who doesn't have a secret recorded.
+        // This fixes a bug where enrol_lti_users records are created first during a member sync, and are missing the secret,
+        // even despite having launched the tool subsequently.
+        $sql = "SELECT lu.id, lc.secret
+                  FROM {enrol_lti_users} lu
+                  JOIN {enrol_lti_lti2_consumer} lc
+                    ON (lu.consumerkey = lc.consumerkey256)
+                 WHERE lu.consumersecret IS NULL
+                   AND lu.lastaccess IS NOT NULL";
+        $affectedltiusersrs = $DB->get_recordset_sql($sql);
+        foreach ($affectedltiusersrs as $ltiuser) {
+            $DB->set_field('enrol_lti_users', 'consumersecret', $ltiuser->secret, ['id' => $ltiuser->id]);
+        }
+        $affectedltiusersrs->close();
+
+        // Lti savepoint reached.
+        upgrade_plugin_savepoint(true, 2021051703, 'enrol', 'lti');
+    }
+
     return true;
 }
diff --git a/enrol/lti/version.php b/enrol/lti/version.php
index d9eb0038c6d..d3d5b100f8f 100644
--- a/enrol/lti/version.php
+++ b/enrol/lti/version.php
@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2021051702; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2021051703; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2021051100; // Requires this Moodle version.
 $plugin->component = 'enrol_lti'; // Full name of the plugin (used for diagnostics).