diff --git a/go.mod b/go.mod
index 232f73b..bbb82d7 100644
--- a/go.mod
+++ b/go.mod
@@ -25,7 +25,7 @@ require (
 	github.com/patrickmn/go-cache v2.1.0+incompatible
 	github.com/pkg/errors v0.9.1
 	github.com/place1/pg-events v0.2.0
-	github.com/place1/wg-embed v0.4.0
+	github.com/place1/wg-embed v0.4.1
 	github.com/pquerna/cachecontrol v0.0.0-20200921180117-858c6e7e6b7e // indirect
 	github.com/rs/cors v1.7.0 // indirect
 	github.com/sirupsen/logrus v1.7.0
diff --git a/go.sum b/go.sum
index aaa33d1..eb9cad2 100644
--- a/go.sum
+++ b/go.sum
@@ -140,8 +140,8 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/place1/pg-events v0.2.0 h1:7v8byv7GO8Dc2ufdgRgma5RAraC5sOe6q+jnOhN+dk0=
 github.com/place1/pg-events v0.2.0/go.mod h1:IwHKE93V/uyZWui7MY1iaEYbz8MdqJnGbYOSOCICKbo=
-github.com/place1/wg-embed v0.4.0 h1:rToHj4+TuI2ruv2mz3Y16vvisv280BuzdojsGGNQ/pM=
-github.com/place1/wg-embed v0.4.0/go.mod h1:i09dm8AEkurC4oATFxjvyH0+e1pdmtZoNk2FfPupROI=
+github.com/place1/wg-embed v0.4.1 h1:UEh0CXF8KhKsV4oTt4WUQa5BlIrNKv11324/M+uZ1WY=
+github.com/place1/wg-embed v0.4.1/go.mod h1:i09dm8AEkurC4oATFxjvyH0+e1pdmtZoNk2FfPupROI=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20200921180117-858c6e7e6b7e h1:BLqxdwZ6j771IpSCRx7s/GJjXHUE00Hmu7/YegCGdzA=
diff --git a/internal/devices/devices.go b/internal/devices/devices.go
index 05a72e2..f58e4c3 100644
--- a/internal/devices/devices.go
+++ b/internal/devices/devices.go
@@ -27,12 +27,14 @@ func New(wg wgembed.WireGuardInterface, s storage.Storage, cidr string) *DeviceM
 func (d *DeviceManager) StartSync(disableMetadataCollection bool) error {
 	// Start listening to the device add/remove events
 	d.storage.OnAdd(func(device *storage.Device) {
+		logrus.Debugf("storage event: device added: %s/%s", device.Owner, device.Name)
 		if err := d.wg.AddPeer(device.PublicKey, device.Address); err != nil {
 			logrus.Error(errors.Wrap(err, "failed to add wireguard peer"))
 		}
 	})
 
 	d.storage.OnDelete(func(device *storage.Device) {
+		logrus.Debugf("storage event: device removed: %s/%s", device.Owner, device.Name)
 		if err := d.wg.RemovePeer(device.PublicKey); err != nil {
 			logrus.Error(errors.Wrap(err, "failed to remove wireguard peer"))
 		}
diff --git a/internal/devices/metadata.go b/internal/devices/metadata.go
index 580d5d4..35b3301 100644
--- a/internal/devices/metadata.go
+++ b/internal/devices/metadata.go
@@ -15,6 +15,7 @@ func metadataLoop(d *DeviceManager) {
 }
 
 func syncMetrics(d *DeviceManager) {
+	logrus.Debug("metadata sync executing")
 	devices, err := d.ListAllDevices()
 	if err != nil {
 		logrus.Warn(errors.Wrap(err, "failed to list devices - metrics cannot be recorded"))
diff --git a/internal/storage/pgwatcher.go b/internal/storage/pgwatcher.go
index 051eff9..d210fdc 100644
--- a/internal/storage/pgwatcher.go
+++ b/internal/storage/pgwatcher.go
@@ -29,7 +29,11 @@ func NewPgWatcher(connectionString string, table string) (*PgWatcher, error) {
 
 func (w *PgWatcher) OnAdd(cb Callback) {
 	w.Listener.OnEvent(func(event *pgevents.TableEvent) {
-		if event.Action == "UPDATE" || event.Action == "INSERT" {
+		// we only emit the "add" event on an insert because wg-access-server
+		// doesn't allow anyone to modify their public key or allowed IPs.
+		// a future change to wg-access-server may require listening to "updates"
+		// if either of those properties become mutable.
+		if event.Action == "INSERT" {
 			w.emit(cb, event)
 		}
 	})
diff --git a/internal/storage/sql.go b/internal/storage/sql.go
index 0e14581..f7971f5 100644
--- a/internal/storage/sql.go
+++ b/internal/storage/sql.go
@@ -155,7 +155,7 @@ func (s *SQLStorage) List(username string) ([]*Device, error) {
 		err = s.db.Find(&devices).Error
 	}
 
-	logrus.Debugf("Found devices: %+v", devices)
+	logrus.Debugf("found %d device(s)", len(devices))
 	if err != nil {
 		return nil, errors.Wrapf(err, "failed to read devices from sql")
 	}