diff --git a/app/sql.js b/app/sql.js
index fb5581f6d..0c2589efa 100644
--- a/app/sql.js
+++ b/app/sql.js
@@ -1540,6 +1540,8 @@ async function getGrantAuthorisationsForPrimaryPubKey(primaryDevicePubKey) {
 
 async function createOrUpdatePairingAuthorisation(data) {
   const { primaryDevicePubKey, secondaryDevicePubKey, grantSignature } = data;
+  // remove any existing authorisation for this pubkey (we allow only one secondary device for now)
+  await removePairingAuthorisationForPrimaryPubKey(primaryDevicePubKey);
 
   await db.run(
     `INSERT OR REPLACE INTO ${PAIRING_AUTHORISATIONS_TABLE} (
@@ -1562,6 +1564,15 @@ async function createOrUpdatePairingAuthorisation(data) {
   );
 }
 
+async function removePairingAuthorisationForPrimaryPubKey(pubKey) {
+  await db.run(
+    `DELETE FROM ${PAIRING_AUTHORISATIONS_TABLE} WHERE primaryDevicePubKey = $primaryDevicePubKey;`,
+    {
+      $primaryDevicePubKey: pubKey,
+    }
+  );
+}
+
 async function removePairingAuthorisationForSecondaryPubKey(pubKey) {
   await db.run(
     `DELETE FROM ${PAIRING_AUTHORISATIONS_TABLE} WHERE secondaryDevicePubKey = $secondaryDevicePubKey;`,