diff --git a/src/devices/nm-device.c b/src/devices/nm-device.c
index f47331f230..94a491544b 100644
--- a/src/devices/nm-device.c
+++ b/src/devices/nm-device.c
@@ -67,6 +67,7 @@
 #include "settings/nm-settings.h"
 #include "nm-setting-ethtool.h"
 #include "nm-auth-utils.h"
+#include "nm-keep-alive.h"
 #include "nm-netns.h"
 #include "nm-dispatcher.h"
 #include "nm-config.h"
@@ -11870,9 +11871,24 @@ do_fail:
 void
 nm_device_queue_activation (NMDevice *self, NMActRequest *req)
 {
-	NMDevicePrivate *priv = NM_DEVICE_GET_PRIVATE (self);
+	NMDevicePrivate *priv;
 	gboolean must_queue;
 
+	g_return_if_fail (NM_IS_DEVICE (self));
+	g_return_if_fail (NM_IS_ACT_REQUEST (req));
+
+	nm_keep_alive_arm (nm_active_connection_get_keep_alive (NM_ACTIVE_CONNECTION (req)));
+
+	if (nm_active_connection_get_state (NM_ACTIVE_CONNECTION (req)) >= NM_ACTIVE_CONNECTION_STATE_DEACTIVATING) {
+		/* it's already deactivating. Nothing to do. */
+		nm_assert (NM_IN_SET (nm_active_connection_get_device (NM_ACTIVE_CONNECTION (req)), NULL, self));
+		return;
+	}
+
+	nm_assert (self == nm_active_connection_get_device (NM_ACTIVE_CONNECTION (req)));
+
+	priv = NM_DEVICE_GET_PRIVATE (self);
+
 	must_queue = _carrier_wait_check_act_request_must_queue (self, req);
 
 	if (   !priv->act_request.obj
diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 6d504e0e4d..96f164638d 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -1472,10 +1472,8 @@ constructed (GObject *object)
 
 	if (NM_IN_SET ((NMActivationReason) priv->activation_reason,
 	               NM_ACTIVATION_REASON_AUTOCONNECT,
-	               NM_ACTIVATION_REASON_AUTOCONNECT_SLAVES)) {
+	               NM_ACTIVATION_REASON_AUTOCONNECT_SLAVES))
 		nm_keep_alive_set_settings_connection_watch_visible (priv->keep_alive, priv->settings_connection.obj);
-		nm_keep_alive_arm (priv->keep_alive);
-	}
 }
 
 static void
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 00eaf4a94b..ab9571f6df 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -2237,6 +2237,8 @@ active_connection_added (NMManager *manager,
 
 	keep_alive = nm_active_connection_get_keep_alive (active);
 
+	nm_keep_alive_arm (keep_alive);
+
 	g_signal_connect (active, "notify::" NM_ACTIVE_CONNECTION_STATE,
 	                  G_CALLBACK (active_connection_state_changed),
 	                  self);