diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2f70c10c..975defb4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,8 @@
+### master
+
+* bug fixes
+  * Do not modify `:except` option given to `#serializable_hash`. (by @dpep)
+
 ### 4.7.2 - 2020-06-10
 
 * enhancements
diff --git a/lib/devise/models/authenticatable.rb b/lib/devise/models/authenticatable.rb
index 93582e21..9d456fa3 100644
--- a/lib/devise/models/authenticatable.rb
+++ b/lib/devise/models/authenticatable.rb
@@ -104,7 +104,7 @@ module Devise
       # given to :except will simply add names to exempt to Devise internal list.
       def serializable_hash(options = nil)
         options = options.try(:dup) || {}
-        options[:except] = Array(options[:except])
+        options[:except] = Array(options[:except]).dup
 
         if options[:force_except]
           options[:except].concat Array(options[:force_except])
diff --git a/test/models/serializable_test.rb b/test/models/serializable_test.rb
index 0ec9e720..245da05a 100644
--- a/test/models/serializable_test.rb
+++ b/test/models/serializable_test.rb
@@ -43,7 +43,7 @@ class SerializableTest < ActiveSupport::TestCase
   end
 
   test 'should accept frozen options' do
-    assert_key "username", @user.as_json({only: :username}.freeze)["user"]
+    assert_key "username", @user.as_json({ only: :username, except: [:email].freeze }.freeze)["user"]
   end
 
   def assert_key(key, subject)