diff --git a/Gemfile.lock b/Gemfile.lock
index c0a100e3..64a3ae92 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -13,7 +13,7 @@ PATH
     devise (4.4.1)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0, < 5.2)
+      railties (>= 4.1.0, < 6.0)
       responders
       warden (~> 1.2.3)
 
diff --git a/lib/devise/models/trackable.rb b/lib/devise/models/trackable.rb
index 9a3056e9..e0be240a 100644
--- a/lib/devise/models/trackable.rb
+++ b/lib/devise/models/trackable.rb
@@ -31,8 +31,13 @@ module Devise
       end
 
       def update_tracked_fields!(request)
+        # We have to check if the user is already persisted before running
+        # `save` here because invalid users can be saved if we don't.
+        # See https://github.com/plataformatec/devise/issues/4673 for more details.
+        return if new_record?
+
         update_tracked_fields(request)
-        save
+        save(validate: false)
       end
     end
   end