diff --git a/core/docs/changelog/ZO-4801.change b/core/docs/changelog/ZO-4801.change
new file mode 100644
index 0000000000..ae07670eb6
--- /dev/null
+++ b/core/docs/changelog/ZO-4801.change
@@ -0,0 +1 @@
+ZO-4801: Fix saving audio reference on article
diff --git a/core/src/zeit/cms/content/reference.py b/core/src/zeit/cms/content/reference.py
index 777940a5c2..1c34395357 100644
--- a/core/src/zeit/cms/content/reference.py
+++ b/core/src/zeit/cms/content/reference.py
@@ -124,7 +124,7 @@ def __set__(self, instance, value):
         else:
             for node in self._reference_nodes(instance):
                 node.getparent().remove(node)
-            parent, name = create_parent_nodes(self.path, instance.xml)
+            parent, name = create_parent_nodes(self.path, xml)
             for node in value:
                 node.tag = name
                 parent.append(node)
diff --git a/core/src/zeit/cms/content/tests/test_reference.py b/core/src/zeit/cms/content/tests/test_reference.py
index 273fba95f2..1a10455f55 100644
--- a/core/src/zeit/cms/content/tests/test_reference.py
+++ b/core/src/zeit/cms/content/tests/test_reference.py
@@ -223,6 +223,19 @@ def test_works_with_security(self):
         content.references = content.references.create(target)
         self.assertEqual('http://xml.zeit.de/target', content.references.target.uniqueId)
 
+    def test_works_with_security_on_adapter(self):
+        target = zope.security.proxy.ProxyFactory(self.repository['target'])
+        with checked_out(self.repository['content']) as co:
+            content = zope.security.proxy.ProxyFactory(co)
+            # The IRelatedContent adapter is registered with trusted=true,
+            # but it's unclear whether this is the general contract for these:
+            # ReferenceProperty already does use removeSecurityProxy, and there
+            # also currently are some adapters that do not use trusted (e.g.
+            # z.c.audio). So we probably ought to support this case.
+            related = zeit.cms.related.related.RelatedContent(content)
+            related.related = (target,)
+            self.assertEqual('http://xml.zeit.de/target', related.related[0].uniqueId)
+
 
 class MultiResourceTest(ReferenceFixture, zeit.cms.testing.ZeitCmsTestCase):
     def setUp(self):