diff --git a/keystone/token/persistence/backends/sql.py b/keystone/token/persistence/backends/sql.py
index f74926919c..f0bcb1e532 100644
--- a/keystone/token/persistence/backends/sql.py
+++ b/keystone/token/persistence/backends/sql.py
@@ -269,7 +269,12 @@ class Token(token.persistence.TokenDriverV8):
         return _expiry_range_all
 
     def flush_expired_tokens(self):
-        with sql.session_for_write() as session:
+        # The DBAPI itself is in a "never autocommit" mode,
+        # BEGIN is emitted automatically as soon as any work is done,
+        # COMMIT is emitted when SQLAlchemy invokes commit() on the
+        # underlying DBAPI connection. So SQLAlchemy is only simulating
+        # "begin" here in any case, it is in fact automatic by the DBAPI.
+        with sql.session_for_write() as session:  # Calls session.begin()
             dialect = session.bind.dialect.name
             expiry_range_func = self._expiry_range_strategy(dialect)
             query = session.query(TokenModel.expires)
@@ -279,8 +284,17 @@ class Token(token.persistence.TokenDriverV8):
                 delete_query = query.filter(TokenModel.expires <=
                                             expiry_time)
                 row_count = delete_query.delete(synchronize_session=False)
+                # Explicitly commit each batch so as to free up
+                # resources early. We do not actually need
+                # transactional semantics here.
+                session.commit()  # Emits connection.commit() on DBAPI
+                # Tells SQLAlchemy to "begin", e.g. hold a new connection
+                # open in a transaction
+                session.begin()
                 total_removed += row_count
                 LOG.debug('Removed %d total expired tokens', total_removed)
 
+            # When the "with: " block ends, the final "session.commit()"
+            # is emitted by enginefacade
             session.flush()
             LOG.info(_LI('Total expired tokens removed: %d'), total_removed)
diff --git a/releasenotes/notes/bug-1649616-b835d1dac3401e8c.yaml b/releasenotes/notes/bug-1649616-b835d1dac3401e8c.yaml
new file mode 100644
index 0000000000..a7df50b1a0
--- /dev/null
+++ b/releasenotes/notes/bug-1649616-b835d1dac3401e8c.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    [`bug 1689616 <https://bugs.launchpad.net/keystone/+bug/1649616>`_]
+    Significant improvements have been made when performing a token flush
+    on massive data sets.