diff --git a/lib/web/terminal.go b/lib/web/terminal.go
index 8d676cf0d43e8..dfdf1dc80d7ff 100644
--- a/lib/web/terminal.go
+++ b/lib/web/terminal.go
@@ -620,7 +620,12 @@ func newMFACeremony(stream *terminal.WSStream, createAuthenticateChallenge mfa.C
 			return newMFAPrompt(stream, channelID)
 		},
 		SSOMFACeremonyConstructor: func(ctx context.Context) (mfa.SSOMFACeremony, error) {
-			channelID = uuid.NewString()
+			id, err := uuid.NewRandom()
+			if err != nil {
+				return nil, trace.Wrap(err)
+			}
+			channelID = id.String()
+
 			u, err := url.Parse(sso.WebMFARedirect)
 			if err != nil {
 				return nil, trace.Wrap(err)