diff --git a/synapse/handlers/_base.py b/synapse/handlers/_base.py
index 5613bd2059..5b27ec1362 100644
--- a/synapse/handlers/_base.py
+++ b/synapse/handlers/_base.py
@@ -342,6 +342,12 @@ class BaseHandler(object):
                         "You don't have permission to redact events"
                     )
 
+        if event.type == EventTypes.Create and context.current_state:
+            raise AuthError(
+                403,
+                "Changing the room create event is forbidden",
+            )
+
         action_generator = ActionGenerator(self.hs)
         yield action_generator.handle_push_actions_for_event(
             event, context, self