diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index f107dc35fe..93d63a0411 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -455,8 +455,8 @@ static gboolean dhcp6_start (NMDevice *self, gboolean wait_for_ll, NMDeviceState
 static void nm_device_start_ip_check (NMDevice *self);
 static void realize_start_setup (NMDevice *self, const NMPlatformLink *plink);
 static void nm_device_set_mtu (NMDevice *self, guint32 mtu);
-
 static void dhcp_schedule_restart (NMDevice *self, int family, const char *reason);
+static void _cancel_activation (NMDevice *self);
 
 /***********************************************************/
 
@@ -2810,6 +2810,8 @@ nm_device_slave_notify_release (NMDevice *self, NMDeviceStateReason reason)
 		       nm_connection_get_id (connection),
 		       master_status);
 
+		/* Cancel any pending activation sources */
+		_cancel_activation (self);
 		nm_device_queue_state (self, new_state, reason);
 	} else
 		_LOGI (LOGD_DEVICE, "released from master device %s", nm_device_get_iface (priv->master));
@@ -3952,15 +3954,21 @@ nm_device_activate_schedule_stage2_device_config (NMDevice *self)
 
 	if (!priv->master_ready_handled) {
 		NMActiveConnection *active = NM_ACTIVE_CONNECTION (priv->act_request);
+		NMActiveConnection *master;
 
-		if (!nm_active_connection_get_master (active)) {
+		master = nm_active_connection_get_master (active);
+
+		if (!master) {
 			g_warn_if_fail (!priv->master_ready_id);
 			priv->master_ready_handled = TRUE;
 		} else {
 			/* If the master connection is ready for slaves, attach ourselves */
 			if (nm_active_connection_get_master_ready (active))
 				master_ready (self, active);
-			else {
+			else if (nm_active_connection_get_state (master) >= NM_ACTIVE_CONNECTION_STATE_DEACTIVATING) {
+				_LOGD (LOGD_DEVICE, "master connection is deactivating");
+				nm_device_state_changed (self, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_DEPENDENCY_FAILED);
+			} else {
 				_LOGD (LOGD_DEVICE, "waiting for master connection to become ready");
 
 				if (priv->master_ready_id == 0) {
diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 2b7847b2df..8b1824225f 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -719,14 +719,14 @@ nm_active_connection_get_assumed (NMActiveConnection *self)
 
 /****************************************************************/
 
-static void unwatch_parent (NMActiveConnection *self);
+static void unwatch_parent (NMActiveConnection *self, gboolean unref);
 
 static void
 parent_destroyed (gpointer user_data, GObject *parent)
 {
 	NMActiveConnection *self = user_data;
 
-	unwatch_parent (self);
+	unwatch_parent (self, FALSE);
 	g_signal_emit (self, signals[PARENT_ACTIVE], 0, NULL);
 }
 
@@ -741,19 +741,20 @@ parent_state_cb (NMActiveConnection *parent_ac,
 	if (parent_state < NM_ACTIVE_CONNECTION_STATE_ACTIVATED)
 		return;
 
-	unwatch_parent (self);
+	unwatch_parent (self, TRUE);
 	g_signal_emit (self, signals[PARENT_ACTIVE], 0, parent_ac);
 }
 
 static void
-unwatch_parent (NMActiveConnection *self)
+unwatch_parent (NMActiveConnection *self, gboolean unref)
 {
 	NMActiveConnectionPrivate *priv = NM_ACTIVE_CONNECTION_GET_PRIVATE (self);
 
 	g_signal_handlers_disconnect_by_func (priv->parent,
 	                                      (GCallback) parent_state_cb,
 	                                      self);
-	g_object_weak_unref ((GObject *) priv->parent, parent_destroyed, self);
+	if (unref)
+		g_object_weak_unref ((GObject *) priv->parent, parent_destroyed, self);
 	priv->parent = NULL;
 }
 
@@ -1135,7 +1136,7 @@ dispose (GObject *object)
 	g_clear_object (&priv->master);
 
 	if (priv->parent)
-		unwatch_parent (self);
+		unwatch_parent (self, TRUE);
 
 	g_clear_object (&priv->subject);
 
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 0c63b1cba6..0af67425ed 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -1023,8 +1023,10 @@ activate_slave_connections (NMPolicy *self, NMDevice *device)
 {
 	NMPolicyPrivate *priv = NM_POLICY_GET_PRIVATE (self);
 	const char *master_device, *master_uuid_settings = NULL, *master_uuid_applied = NULL;
-	GSList *connections, *iter;
+	gs_free_slist GSList *connections = NULL;
+	GSList *iter;
 	NMActRequest *req;
+	gboolean internal_activation = FALSE;
 
 	master_device = nm_device_get_iface (device);
 	g_assert (master_device);
@@ -1032,6 +1034,7 @@ activate_slave_connections (NMPolicy *self, NMDevice *device)
 	req = nm_device_get_act_request (device);
 	if (req) {
 		NMConnection *con;
+		NMAuthSubject *subject;
 
 		con = nm_active_connection_get_applied_connection (NM_ACTIVE_CONNECTION (req));
 		if (con)
@@ -1042,9 +1045,14 @@ activate_slave_connections (NMPolicy *self, NMDevice *device)
 			if (!g_strcmp0 (master_uuid_settings, master_uuid_applied))
 				master_uuid_settings = NULL;
 		}
+
+		subject = nm_active_connection_get_subject (NM_ACTIVE_CONNECTION (req));
+		internal_activation = subject && nm_auth_subject_is_internal (subject);
 	}
 
-	connections = nm_settings_get_connections_sorted (priv->settings);
+	if (!internal_activation)
+		connections = nm_settings_get_connections_sorted (priv->settings);
+
 	for (iter = connections; iter; iter = g_slist_next (iter)) {
 		NMConnection *slave;
 		NMSettingConnection *s_slave_con;
@@ -1065,8 +1073,6 @@ activate_slave_connections (NMPolicy *self, NMDevice *device)
 			nm_settings_connection_reset_autoconnect_retries (NM_SETTINGS_CONNECTION (slave));
 	}
 
-	g_slist_free (connections);
-
 	schedule_activate_all (self);
 }