diff --git a/controller/store/accessGrant.go b/controller/store/accessGrant.go
index 84428663..f8f19067 100644
--- a/controller/store/accessGrant.go
+++ b/controller/store/accessGrant.go
@@ -59,3 +59,15 @@ func (str *Store) DeleteAccessGrant(id int, tx *sqlx.Tx) error {
 	}
 	return nil
 }
+
+func (str *Store) DeleteAccessGrantsForShare(shrId int, tx *sqlx.Tx) error {
+	stmt, err := tx.Prepare("update access_grants set updated_at = current_timestamp, deleted = true where share_id = $1")
+	if err != nil {
+		return errors.Wrap(err, "error preparing access_grants delete for shares statement")
+	}
+	_, err = stmt.Exec(shrId)
+	if err != nil {
+		return errors.Wrap(err, "error executing access_grants delete for shares statement")
+	}
+	return nil
+}
diff --git a/controller/unshare.go b/controller/unshare.go
index eab9a346..cbadcfcc 100644
--- a/controller/unshare.go
+++ b/controller/unshare.go
@@ -79,8 +79,12 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
 		h.deallocateResources(senv, shrToken, shrZId, edge)
 		logrus.Debugf("deallocated share '%v'", shrToken)
 
+		if err := str.DeleteAccessGrantsForShare(sshr.Id, tx); err != nil {
+			logrus.Errorf("error deleting access grants for share '%v': %v", shrToken, err)
+			return share.NewUnshareInternalServerError()
+		}
 		if err := str.DeleteShare(sshr.Id, tx); err != nil {
-			logrus.Errorf("error deactivating share '%v': %v", shrZId, err)
+			logrus.Errorf("error deleting share '%v': %v", shrToken, err)
 			return share.NewUnshareInternalServerError()
 		}
 		if err := tx.Commit(); err != nil {