diff --git a/Gemfile b/Gemfile
index 303014731..9f5eb0800 100644
--- a/Gemfile
+++ b/Gemfile
@@ -32,7 +32,8 @@ gem "roo"
 # Json Schema
 gem "json-schema"
 # Authentication
-gem "devise"
+# Point at branch until devise is compatible with Turbo, see https://github.com/heartcombo/devise/pull/5340
+gem "devise", github: "ghiculescu/devise", branch: "error-code-422"
 gem "turbo-rails", "~> 0.8"
 gem "uk_postcode"
 
diff --git a/Gemfile.lock b/Gemfile.lock
index b64e1380e..edbac9d8e 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -1,3 +1,15 @@
+GIT
+  remote: https://github.com/ghiculescu/devise.git
+  revision: 3b2d9ae3d47be5c9228c4446119b04b0e98917c1
+  branch: error-code-422
+  specs:
+    devise (4.8.0)
+      bcrypt (~> 3.0)
+      orm_adapter (~> 0.1)
+      railties (>= 4.1.0)
+      responders
+      warden (~> 1.2.3)
+
 GIT
   remote: https://github.com/rspec/rspec-core.git
   revision: e36aa2a9ebe68acee3ce05190fc2124947b45925
@@ -148,12 +160,6 @@ GEM
     concurrent-ruby (1.1.9)
     crass (1.0.6)
     deep_merge (1.2.1)
-    devise (4.8.0)
-      bcrypt (~> 3.0)
-      orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
-      responders
-      warden (~> 1.2.3)
     diff-lcs (1.4.4)
     discard (1.2.0)
       activerecord (>= 4.2, < 7)
@@ -408,7 +414,7 @@ DEPENDENCIES
   capybara
   capybara-lockstep
   chartkick
-  devise
+  devise!
   discard
   dotenv-rails
   factory_bot_rails
diff --git a/app/helpers/devise_helper.rb b/app/helpers/devise_helper.rb
new file mode 100644
index 000000000..b3ab70d08
--- /dev/null
+++ b/app/helpers/devise_helper.rb
@@ -0,0 +1,8 @@
+module DeviseHelper
+  def flash_to_model_errors(resource)
+    if flash.alert
+      resource.errors.add :base, flash.alert
+      flash.discard
+    end
+  end
+end
diff --git a/app/views/devise/sessions/new.html.erb b/app/views/devise/sessions/new.html.erb
index 5ad69b2fe..cdea06c3e 100644
--- a/app/views/devise/sessions/new.html.erb
+++ b/app/views/devise/sessions/new.html.erb
@@ -3,6 +3,9 @@
     <div class="govuk-grid-column-two-thirds">
       <h1 class="govuk-heading-l">Sign in to your account to submit CORE data</h1>
 
+      <% flash_to_model_errors(resource) %>
+      <%= f.govuk_error_summary %>
+
       <%= f.govuk_email_field :email,
         label: { text: "Email address" },
         autocomplete: "email"
diff --git a/app/views/layouts/application.html.erb b/app/views/layouts/application.html.erb
index 7cfc25059..7cf768008 100644
--- a/app/views/layouts/application.html.erb
+++ b/app/views/layouts/application.html.erb
@@ -56,12 +56,12 @@
       </div>
 
       <main class="govuk-main-wrapper" id="main-content" role="main">
-        <% flash.each do |type, msg| %>
+        <% if flash.notice %>
           <%= govuk_notification_banner(
             title_text: 'Success',
             success: true, title_heading_level: 3,
             title_id: "swanky-notifications") do |notification_banner|
-              notification_banner.heading(text: msg)
+              notification_banner.heading(text: flash.notice)
             end
           %>
         <% end %>
diff --git a/spec/features/user_spec.rb b/spec/features/user_spec.rb
index e41551845..561a25e02 100644
--- a/spec/features/user_spec.rb
+++ b/spec/features/user_spec.rb
@@ -13,6 +13,7 @@ RSpec.describe "User Features" do
       fill_in("user[password]", with: "pAssword1")
       click_button("Sign in")
       expect(page).to have_current_path("/case_logs")
+      expect(page).to have_css(".govuk-notification-banner.govuk-notification-banner--success")
     end
   end
 
@@ -80,6 +81,17 @@ RSpec.describe "User Features" do
     end
   end
 
+  context "Trying to log in with incorrect credentials" do
+    it "shows a gov uk error summary and no flash message" do
+      visit("/case_logs")
+      fill_in("user[email]", with: user.email)
+      fill_in("user[password]", with: "nonsense")
+      click_button("Sign in")
+      expect(page).to have_selector("#error-summary-title")
+      expect(page).to have_no_css(".govuk-notification-banner.govuk-notification-banner--success")
+    end
+  end
+
   context "Your Account " do
     before(:each) do
       visit("/case_logs")