diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb
index a469130a8..738caa180 100644
--- a/app/controllers/posts_controller.rb
+++ b/app/controllers/posts_controller.rb
@@ -80,8 +80,9 @@ class PostsController < ApplicationController
   end
 
   def random
-    @post = authorize Post.tag_match(params[:tags]).random
+    @post = Post.tag_match(params[:tags]).random
     raise ActiveRecord::RecordNotFound if @post.nil?
+    authorize @post
     respond_with(@post) do |format|
       format.html { redirect_to post_path(@post, :tags => params[:tags]) }
     end
diff --git a/test/functional/posts_controller_test.rb b/test/functional/posts_controller_test.rb
index 83bd9967e..c4ac38dcd 100644
--- a/test/functional/posts_controller_test.rb
+++ b/test/functional/posts_controller_test.rb
@@ -205,6 +205,11 @@ class PostsControllerTest < ActionDispatch::IntegrationTest
         get random_posts_path, params: { tags: "aaaa" }
         assert_redirected_to(post_path(@post, tags: "aaaa"))
       end
+
+      should "return a 404 when no random posts can be found" do
+        get random_posts_path, params: { tags: "qoigjegoi" }
+        assert_response 404
+      end
     end
 
     context "show action" do