diff --git a/database/middleware.go b/database/middleware.go
index adbf56bf0852e5984251d349349ac5e12242f1ab..23449149aadd12cd42d7fd8c57ea83e19919def4 100644
--- a/database/middleware.go
+++ b/database/middleware.go
@@ -3,6 +3,7 @@
 import (
 	"context"
 	"database/sql"
+	sqldriver "database/sql/driver"
 	"errors"
 	"net/http"
 )
@@ -45,22 +46,30 @@ }
 
 func WithTx(ctx context.Context, opts *sql.TxOptions, fn func(tx *sql.Tx) error) error {
 	db := DBForContext(ctx)
+
 	tx, err := db.BeginTx(ctx, opts)
 	if err != nil {
 		return err
 	}
 	defer tx.Rollback()
+
 	err = fn(tx)
+
+	var txErr error
 	if err != nil {
-		err := tx.Rollback()
-		if err != nil && err != sql.ErrTxDone {
-			panic(err)
-		}
+		txErr = tx.Rollback()
 	} else {
-		err := tx.Commit()
-		if err != nil && err != sql.ErrTxDone {
-			panic(err)
-		}
+		txErr = tx.Commit()
+	}
+
+	if errors.Is(err, context.Canceled) && errors.Is(txErr, sqldriver.ErrBadConn) {
+		// When a query fails because the context has been canceled, pq will
+		// return "driver: bad connection" from tx.Rollback. Do not panic in
+		// this case. See https://github.com/lib/pq/issues/1137
+		return err
+	}
+	if txErr != nil && txErr != sql.ErrTxDone {
+		panic(err)
 	}
 	return err
 }