diff --git a/CHANGELOG.md b/CHANGELOG.md
index eaf9a44228..124cacd73a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Features
 
+- program: all token 22 use immutable owner ([#1904](https://github.com/drift-labs/protocol-v2/pull/1904))
 - program: allow resolve perp pnl deficit if pnl pool isnt 0 but at deficit ([#1909](https://github.com/drift-labs/protocol-v2/pull/1909))
 - program: auction order params account for twap divergence ([#1882](https://github.com/drift-labs/protocol-v2/pull/1882))
 - program: add delegate stake if ([#1859](https://github.com/drift-labs/protocol-v2/pull/1859))
diff --git a/programs/drift/src/controller/token.rs b/programs/drift/src/controller/token.rs
index 6e5d03193e..d9fd82230a 100644
--- a/programs/drift/src/controller/token.rs
+++ b/programs/drift/src/controller/token.rs
@@ -217,3 +217,16 @@ pub fn initialize_token_account<'info>(
 
     Ok(())
 }
+
+pub fn initialize_immutable_owner<'info>(
+    token_program: &Interface<'info, TokenInterface>,
+    account: &AccountInfo<'info>,
+) -> Result<()> {
+    let accounts = ::anchor_spl::token_interface::InitializeImmutableOwner {
+        account: account.to_account_info(),
+    };
+    let cpi_ctx = anchor_lang::context::CpiContext::new(token_program.to_account_info(), accounts);
+    ::anchor_spl::token_interface::initialize_immutable_owner(cpi_ctx)?;
+
+    Ok(())
+}
diff --git a/programs/drift/src/instructions/admin.rs b/programs/drift/src/instructions/admin.rs
index 9f29229fe4..4707078481 100644
--- a/programs/drift/src/instructions/admin.rs
+++ b/programs/drift/src/instructions/admin.rs
@@ -10,7 +10,7 @@ use pyth_solana_receiver_sdk::cpi::accounts::InitPriceUpdate;
 use pyth_solana_receiver_sdk::program::PythSolanaReceiver;
 use serum_dex::state::ToAlignedBytes;
 
-use crate::controller::token::{close_vault, initialize_token_account};
+use crate::controller::token::{close_vault, initialize_immutable_owner, initialize_token_account};
 use crate::error::ErrorCode;
 use crate::ids::{admin_hot_wallet, amm_spread_adjust_wallet, mm_oracle_crank_wallet};
 use crate::instructions::constraints::*;
@@ -148,6 +148,16 @@ pub fn handle_initialize_spot_market(
     let state = &mut ctx.accounts.state;
     let spot_market_pubkey = ctx.accounts.spot_market.key();
 
+    let is_token_2022 = *ctx.accounts.spot_market_mint.to_account_info().owner == Token2022::id();
+    if is_token_2022 {
+        initialize_immutable_owner(&ctx.accounts.token_program, &ctx.accounts.spot_market_vault)?;
+
+        initialize_immutable_owner(
+            &ctx.accounts.token_program,
+            &ctx.accounts.insurance_fund_vault,
+        )?;
+    }
+
     initialize_token_account(
         &ctx.accounts.token_program,
         &ctx.accounts.spot_market_vault,
diff --git a/programs/drift/src/instructions/constraints.rs b/programs/drift/src/instructions/constraints.rs
index c983ea471f..23deccd715 100644
--- a/programs/drift/src/instructions/constraints.rs
+++ b/programs/drift/src/instructions/constraints.rs
@@ -159,15 +159,13 @@ pub fn get_vault_len(mint: &InterfaceAccount<Mint>) -> anchor_lang::Result<usize
         let mint_state = StateWithExtensions::<Mint>::unpack(&mint_data)?;
         let mint_extensions = match mint_state.get_extension_types() {
             Ok(extensions) => extensions,
-            // If we cant deserialize the mint, we use the default token account length
+            // If we cant deserialize the mint, try assuming no extensions
             // Init token will fail if this size doesnt work, so worst case init account just fails
-            Err(_) => {
-                msg!("Failed to deserialize mint. Falling back to default token account length");
-                return Ok(::anchor_spl::token::TokenAccount::LEN);
-            }
+            Err(_) => vec![],
         };
-        let required_extensions =
+        let mut required_extensions =
             ExtensionType::get_required_init_account_extensions(&mint_extensions);
+        required_extensions.push(ExtensionType::ImmutableOwner);
         ExtensionType::try_calculate_account_len::<Account>(&required_extensions)?
     } else {
         ::anchor_spl::token::TokenAccount::LEN