diff --git a/bubble-server/src/main/java/bubble/dao/device/DeviceDAO.java b/bubble-server/src/main/java/bubble/dao/device/DeviceDAO.java
index 7f90f081..7490b5ad 100644
--- a/bubble-server/src/main/java/bubble/dao/device/DeviceDAO.java
+++ b/bubble-server/src/main/java/bubble/dao/device/DeviceDAO.java
@@ -120,12 +120,12 @@ public class DeviceDAO extends AccountOwnedEntityDAO<Device> {
     }
 
     @Override @NonNull public Device update(@NonNull final Device updateRequest) {
-        final var toUpdate = (Device) readOnlySession().get(Device.class, updateRequest.getUuid());
+        final Device toUpdate = (Device) readOnlySession().get(Device.class, updateRequest.getUuid());
         if (toUpdate == null) die("Cannot find device to update with uuid: " + updateRequest.getUuid());
         if (toUpdate.uninitialized()) die("Cannot update special devices: " + updateRequest.getName());
 
         toUpdate.update(updateRequest);
-        final var updated = super.update(toUpdate);
+        final Device updated = super.update(toUpdate);
         deviceService.setDeviceSecurityLevel(updated);
         refreshVpnUsers();
         return updated;
diff --git a/bubble-server/src/main/java/bubble/dao/device/FlexRouterDAO.java b/bubble-server/src/main/java/bubble/dao/device/FlexRouterDAO.java
index 5ffaa003..9e4cd68f 100644
--- a/bubble-server/src/main/java/bubble/dao/device/FlexRouterDAO.java
+++ b/bubble-server/src/main/java/bubble/dao/device/FlexRouterDAO.java
@@ -83,9 +83,9 @@ public class FlexRouterDAO extends AccountOwnedEntityDAO<FlexRouter> implements
     @Override public void deleteDevice(String uuid) {
         final int count = bulkDelete("device", uuid);
         if (count <= 1) {
-            log.info("deleteDevice: deleted "+count+" TrustedClient records for device "+uuid);
+            log.info("deleteDevice: deleted "+count+" FlexRouter records for device "+uuid);
         } else {
-            log.warn("deleteDevice: deleted "+count+" TrustedClient records (expected only 1) for device "+uuid);
+            log.warn("deleteDevice: deleted "+count+" FlexRouter records (expected only 1) for device "+uuid);
         }
     }
 
diff --git a/bubble-server/src/main/java/bubble/resources/device/DevicesResource.java b/bubble-server/src/main/java/bubble/resources/device/DevicesResource.java
index c21b3611..17760aa8 100644
--- a/bubble-server/src/main/java/bubble/resources/device/DevicesResource.java
+++ b/bubble-server/src/main/java/bubble/resources/device/DevicesResource.java
@@ -86,9 +86,10 @@ public class DevicesResource extends AccountOwnedResource<Device, DeviceDAO> {
             device.initTotpKey();
         }
 
+        // always set to default level upon registration. user can change later.
         final DeviceSecurityLevel defaultSecurityLevel = deviceService.getDefaultSecurityLevel(device.getDeviceType());
-        log.info("setReferences: no securityLevel, setting to default for type "+device.getDeviceType()+": "+ defaultSecurityLevel);
-        if (!device.hasSecurityLevel()) device.setSecurityLevel(defaultSecurityLevel);
+        device.setSecurityLevel(defaultSecurityLevel);
+        log.info("setReferences: set securityLevel="+defaultSecurityLevel+" for device: "+device+" with type="+device.getDeviceType());
 
         return super.setReferences(ctx, caller, device);
     }
diff --git a/bubble-server/src/main/resources/messages b/bubble-server/src/main/resources/messages
index 5c931705..85fdd6f7 160000
--- a/bubble-server/src/main/resources/messages
+++ b/bubble-server/src/main/resources/messages
@@ -1 +1 @@
-Subproject commit 5c9317053e072a90a4d02dad0dc494fde7dfb790
+Subproject commit 85fdd6f72a2434ecfe75883ae14cd0ea000bbf22