diff --git a/app/Http/Controllers/ConcertOrdersController.php b/app/Http/Controllers/ConcertOrdersController.php
index d7094b6..e4be215 100644
--- a/app/Http/Controllers/ConcertOrdersController.php
+++ b/app/Http/Controllers/ConcertOrdersController.php
@@ -18,6 +18,8 @@ class ConcertOrdersController extends Controller
 
     public function store($concertId)
     {
+        $concert = Concert::published()->findOrFail($concertId);
+
         $this->validate(request(), [
             'email' => ['required', 'email'],
             'ticket_quantity' => ['required', 'integer', 'min:1'],
@@ -25,7 +27,6 @@ class ConcertOrdersController extends Controller
         ]);
 
         try {
-            $concert = Concert::find($concertId);
             $this->paymentGateway->charge(request('ticket_quantity') * $concert->ticket_price, request('payment_token'));
             $order = $concert->orderTickets(request('email'), request('ticket_quantity'));
 
diff --git a/tests/features/PurchaseTicketsTest.php b/tests/features/PurchaseTicketsTest.php
index b1d6a84..625b17b 100644
--- a/tests/features/PurchaseTicketsTest.php
+++ b/tests/features/PurchaseTicketsTest.php
@@ -30,9 +30,9 @@ class PurchaseTicketsTest extends TestCase
     }
 
     /** @test */
-    function customer_can_purchase_concert_tickets()
+    function customer_can_purchase_tickets_to_a_published_concert()
     {
-        $concert = factory(Concert::class)->create(['ticket_price' => 3250]);
+        $concert = factory(Concert::class)->states('published')->create(['ticket_price' => 3250]);
 
         $this->orderTickets($concert, [
             'email' => 'john@example.com',
@@ -47,10 +47,26 @@ class PurchaseTicketsTest extends TestCase
         $this->assertEquals(3, $order->tickets()->count());
     }
 
+    /** @test */
+    function cannot_purchase_tickets_to_an_unpublished_concert()
+    {
+        $concert = factory(Concert::class)->states('unpublished')->create();
+
+        $this->orderTickets($concert, [
+            'email' => 'john@example.com',
+            'ticket_quantity' => 3,
+            'payment_token' => $this->paymentGateway->getValidTestToken(),
+        ]);
+
+        $this->assertResponseStatus(404);
+        $this->assertEquals(0, $concert->orders()->count());
+        $this->assertEquals(0, $this->paymentGateway->totalCharges());
+    }
+
     /** @test */
     function an_order_is_not_created_if_payment_fails()
     {
-        $concert = factory(Concert::class)->create(['ticket_price' => 3250]);
+        $concert = factory(Concert::class)->states('published')->create(['ticket_price' => 3250]);
 
         $this->orderTickets($concert, [
             'email' => 'john@example.com',
@@ -66,7 +82,7 @@ class PurchaseTicketsTest extends TestCase
     /** @test */
     function email_is_required_to_purchase_tickets()
     {
-        $concert = factory(Concert::class)->create();
+        $concert = factory(Concert::class)->states('published')->create();
 
         $this->orderTickets($concert, [
             'ticket_quantity' => 3,
@@ -79,7 +95,7 @@ class PurchaseTicketsTest extends TestCase
     /** @test */
     function email_must_be_valid_to_purchase_tickets()
     {
-        $concert = factory(Concert::class)->create();
+        $concert = factory(Concert::class)->states('published')->create();
 
         $this->orderTickets($concert, [
             'email' => 'not-an-email-address',
@@ -93,7 +109,7 @@ class PurchaseTicketsTest extends TestCase
     /** @test */
     function ticket_quantity_is_required_to_purchase_tickets()
     {
-        $concert = factory(Concert::class)->create();
+        $concert = factory(Concert::class)->states('published')->create();
 
         $this->orderTickets($concert, [
             'email' => 'john@example.com',
@@ -106,7 +122,7 @@ class PurchaseTicketsTest extends TestCase
     /** @test */
     function ticket_quantity_must_be_at_least_1_to_purchase_tickets()
     {
-        $concert = factory(Concert::class)->create();
+        $concert = factory(Concert::class)->states('published')->create();
 
         $this->orderTickets($concert, [
             'email' => 'john@example.com',
@@ -120,7 +136,7 @@ class PurchaseTicketsTest extends TestCase
     /** @test */
     function payment_token_is_required()
     {
-        $concert = factory(Concert::class)->create();
+        $concert = factory(Concert::class)->states('published')->create();
 
         $this->orderTickets($concert, [
             'email' => 'john@example.com',