diff --git a/src/api/core/accounts.rs b/src/api/core/accounts.rs
index 2852a3bd..d1cdf384 100644
--- a/src/api/core/accounts.rs
+++ b/src/api/core/accounts.rs
@@ -2177,7 +2177,8 @@ async fn get_auth_requests_pending(headers: Headers, conn: DbConn) -> JsonResult
     Ok(Json(json!({
         "data": auth_requests
             .iter()
-            .filter(|request| request.approved.is_none())
+            // The same set a device answers for itself, see `find_by_user_and_requested_device`.
+            .filter(|request| request.approved.is_none() && !request.is_admin_approval() && !request.is_expired())
             .map(|request| {
             let response_date_utc = request.response_date.map(|response_date| format_date(&response_date));
 
diff --git a/src/db/models/auth_request.rs b/src/db/models/auth_request.rs
index 0472f62f..bda821fe 100644
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -220,16 +220,27 @@ impl AuthRequest {
         .await
     }
 
+    /// The request a device is currently waiting on, if it is still open and still within its
+    /// window.
+    ///
+    /// Only the types a device answers for itself. A request addressed to an administrator is
+    /// answered through the organization and stays open for a week, so counting it here would let
+    /// it shadow the short lived request the user is actually being shown.
+    /// https://github.com/bitwarden/server/blob/main/src/Infrastructure.EntityFramework/Auth/Repositories/Queries/DeviceWithPendingAuthByUserIdQuery.cs
     pub async fn find_by_user_and_requested_device(
         user_uuid: &UserId,
         device_uuid: &DeviceId,
         conn: &DbConn,
     ) -> Option<Self> {
+        let oldest = Utc::now().naive_utc() - Self::user_request_expiration();
+
         conn.run(move |conn| {
             auth_requests::table
                 .filter(auth_requests::user_uuid.eq(user_uuid))
                 .filter(auth_requests::request_device_identifier.eq(device_uuid))
+                .filter(auth_requests::atype.ne(AuthRequestType::AdminApproval as i32))
                 .filter(auth_requests::approved.is_null())
+                .filter(auth_requests::creation_date.gt(oldest))
                 .order_by(auth_requests::creation_date.desc())
                 .first::<Self>(conn)
                 .ok()