diff --git a/CHANGELOG.md b/CHANGELOG.md
index b93050de..20bfc50b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 ## v1.0.16 (TBA)
 
+**Note:** This release contains an important security fix.
+
 ### Enhancements
 
 * [`PowPersistentSession.Plug.Cookie`] Now supports `:persistent_session_cookie_opts` to customize any options that will be passed on to `Plug.Conn.put_resp_cookie/4`
@@ -9,6 +11,7 @@
 * [`PowResetPassword.Phoenix.ResetPasswordController`] When a user doesn't exist will now return success message if `PowEmailConfirmation` extension is enabled
 * [`PowResetPassword.Phoenix.Messages`] Added `PowResetPassword.Phoenix.Messages.maybe_email_has_been_sent/1` and let `PowResetPassword.Phoenix.Messages.email_has_been_sent/1` fall back to it
 * [`PowEmailConfirmation.Phoenix.ControllerCallbacks`] When a user tries to sign up and the email has already been taken the default e-mail confirmation required message will be shown
+* [`Pow.Plug.Session`] Now renews the Plug session each time the Pow session is created or rolled
 
 ### Bug fixes
 
diff --git a/lib/pow/plug/session.ex b/lib/pow/plug/session.ex
index a3f9b596..5ba4ddd7 100644
--- a/lib/pow/plug/session.ex
+++ b/lib/pow/plug/session.ex
@@ -173,6 +173,7 @@ defmodule Pow.Plug.Session do
       |> delete(config)
       |> Conn.put_private(:pow_session_metadata, metadata)
       |> Conn.put_session(session_key, key)
+      |> Conn.configure_session(renew: true)
 
     {conn, user}
   end
diff --git a/test/pow/plug/session_test.exs b/test/pow/plug/session_test.exs
index 6129fbc3..2ddd8d43 100644
--- a/test/pow/plug/session_test.exs
+++ b/test/pow/plug/session_test.exs
@@ -2,7 +2,7 @@ defmodule Pow.Plug.SessionTest do
   use ExUnit.Case
   doctest Pow.Plug.Session
 
-  alias Plug.Conn
+  alias Plug.{Conn, Test}
   alias Pow.{Plug, Plug.Session, Store.Backend.EtsCache, Store.CredentialsCache}
   alias Pow.Test.{ConnHelpers, Ecto.Users.User, EtsCacheMock}
 
@@ -187,6 +187,28 @@ defmodule Pow.Plug.SessionTest do
       assert metadata[:fingerprint] == new_metadata[:fingerprint]
     end
 
+    test "renews plug session", %{conn: new_conn} do
+      opts = Session.init(@default_opts)
+      conn =
+        new_conn
+        |> Session.call(opts)
+        |> Session.do_create(@user, opts)
+        |> Conn.send_resp(200, "")
+
+      assert %{"foobar" => %{value: plug_session_id}} = conn.resp_cookies
+
+      conn =
+        new_conn
+        |> Test.recycle_cookies(conn)
+        |> Session.call(opts)
+        |> Session.do_create(@user, opts)
+        |> Conn.send_resp(200, "")
+
+      assert %{"foobar" => %{value: new_plug_session_id}} = conn.resp_cookies
+
+      refute plug_session_id == new_plug_session_id
+    end
+
     test "creates with custom metadata", %{conn: conn} do
       inserted_at = :os.system_time(:millisecond) - 10
       opts = Session.init(@default_opts)