diff --git a/test/api/v3/integration/tasks/POST-tasks.test.js b/test/api/v3/integration/tasks/POST-tasks.test.js
index e7e72e1389..b8da4a32d3 100644
--- a/test/api/v3/integration/tasks/POST-tasks.test.js
+++ b/test/api/v3/integration/tasks/POST-tasks.test.js
@@ -50,19 +50,9 @@ describe('POST /tasks', () => {
       });
     });
 
-    it('ignores setting history field');
-
-    it('ignores setting createdAt field');
-
-    it('ignores setting updatedAt field');
-
-    it('ignores setting challenge field');
-
-    it('ignores setting completed field');
-
-    it('ignores setting streak field');
-
-    it('ignores setting dateCompleted field');
+    it(`ignores setting userId, history, createdAt,
+                        updatedAt, challenge, completed, streak,
+                        dateCompleted fields`);
 
     it('ignores invalid fields');
   });
diff --git a/test/api/v3/integration/tasks/PUT-tasks_id.test.js b/test/api/v3/integration/tasks/PUT-tasks_id.test.js
index dc7143decf..815d8f1368 100644
--- a/test/api/v3/integration/tasks/PUT-tasks_id.test.js
+++ b/test/api/v3/integration/tasks/PUT-tasks_id.test.js
@@ -22,25 +22,9 @@ describe('PUT /tasks/:id', () => {
       // task = createdTask
     });
 
-    it('ignores setting type field');
-
-    it('ignores setting userId field');
-
-    it('ignores setting history field');
-
-    it('ignores setting createdAt field');
-
-    it('ignores setting updatedAt field');
-
-    it('ignores setting challenge field');
-
-    it('ignores setting value field');
-
-    it('ignores setting completed field');
-
-    it('ignores setting streak field');
-
-    it('ignores setting dateCompleted field');
+    it(`ignores setting _id, type, userId, history, createdAt,
+                        updatedAt, challenge, completed, streak,
+                        dateCompleted fields`);
 
     it('ignores invalid fields');
   });
@@ -97,6 +81,7 @@ describe('PUT /tasks/:id', () => {
     });
 
     it('can update checklists'); // Can it?
+    it('can update tags'); // Can it?
   });
 
   context('dailys', () => {
@@ -129,6 +114,7 @@ describe('PUT /tasks/:id', () => {
     });
 
     it('can update checklists'); // Can it?
+    it('can update tags'); // Can it?
 
     it('updates repeat, even if frequency is set to daily');
 
diff --git a/website/src/controllers/api-v3/tasks.js b/website/src/controllers/api-v3/tasks.js
index 509aafbe02..8a32f66194 100644
--- a/website/src/controllers/api-v3/tasks.js
+++ b/website/src/controllers/api-v3/tasks.js
@@ -174,6 +174,13 @@ api.updateTask = {
         delete req.body.checklist;
         task.checklist = req.body.checklist;
       }
+
+      // If tags are updated -> replace the original ones
+      if (req.body.tags) {
+        delete req.body.tags;
+        task.tags = req.body.tags;
+      }
+
       // TODO merge goes deep into objects, it's ok?
       // TODO also check that array and mixed fields are updated correctly without marking modified
       _.merge(task, Tasks.Task.sanitizeUpdate(req.body));
diff --git a/website/src/models/task.js b/website/src/models/task.js
index 77cd0cfa2f..3ba4f21b22 100644
--- a/website/src/models/task.js
+++ b/website/src/models/task.js
@@ -46,13 +46,13 @@ TaskSchema.plugin(baseModel, {
 });
 
 // A list of additional fields that cannot be set on creation (but can be set on updare)
-let noCreate = ['completed'];
+let noCreate = ['completed']; // TODO completed should be removed for updates too?
 TaskSchema.statics.sanitizeCreate = function sanitizeCreate (createObj) {
   return Task.sanitize(createObj, noCreate); // eslint-disable-line no-use-before-define
 };
 
 // A list of additional fields that cannot be updated (but can be set on creation)
-let noUpdate = ['_id', 'type']; // TODO should prevent changes to checlist.*.id
+let noUpdate = ['_id', 'type'];
 TaskSchema.statics.sanitizeUpdate = function sanitizeUpdate (updateObj) {
   return Task.sanitize(updateObj, noUpdate); // eslint-disable-line no-use-before-define
 };