diff --git a/src/nm-active-connection.c b/src/nm-active-connection.c
index 34f438c0fb..cb4241735f 100644
--- a/src/nm-active-connection.c
+++ b/src/nm-active-connection.c
@@ -86,6 +86,7 @@ enum {
 };
 
 static void check_master_ready (NMActiveConnection *self);
+static void _device_cleanup (NMActiveConnectionPrivate *priv);
 
 /****************************************************************/
 
@@ -146,10 +147,11 @@ nm_active_connection_set_state (NMActiveConnection *self,
 	}
 
 	if (priv->state == NM_ACTIVE_CONNECTION_STATE_DEACTIVATED) {
-		/* Device is no longer relevant when deactivated; emit property change
-		 * notification so clients re-read the value, which will be NULL due to
-		 * conditions in get_property().
+		/* Device is no longer relevant when deactivated. So remove it and
+		 * emit property change notification so clients re-read the value,
+		 * which will be NULL due to conditions in get_property().
 		 */
+		_device_cleanup (priv);
 		g_object_notify (G_OBJECT (self), NM_ACTIVE_CONNECTION_DEVICES);
 	}
 }
@@ -726,6 +728,17 @@ get_property (GObject *object, guint prop_id,
 	}
 }
 
+static void
+_device_cleanup (NMActiveConnectionPrivate *priv)
+{
+	if (priv->device_state_id) {
+		g_assert (priv->device);
+		g_signal_handler_disconnect (priv->device, priv->device_state_id);
+		priv->device_state_id = 0;
+	}
+	g_clear_object (&priv->device);
+}
+
 static void
 dispose (GObject *object)
 {
@@ -743,12 +756,7 @@ dispose (GObject *object)
 
 	g_clear_object (&priv->connection);
 
-	if (priv->device_state_id) {
-		g_assert (priv->device);
-		g_signal_handler_disconnect (priv->device, priv->device_state_id);
-		priv->device_state_id = 0;
-	}
-	g_clear_object (&priv->device);
+	_device_cleanup (priv);
 
 	if (priv->master) {
 		g_signal_handlers_disconnect_by_func (priv->master,
diff --git a/src/vpn-manager/nm-vpn-connection.c b/src/vpn-manager/nm-vpn-connection.c
index d6f0c8d326..e7c3e073eb 100644
--- a/src/vpn-manager/nm-vpn-connection.c
+++ b/src/vpn-manager/nm-vpn-connection.c
@@ -206,6 +206,12 @@ nm_vpn_connection_set_vpn_state (NMVPNConnection *connection,
 	old_vpn_state = priv->vpn_state;
 	priv->vpn_state = vpn_state;
 
+	/* The device gets destroyed by active connection when it enters
+	 * the deactivated state, so we need to ref it for usage below.
+	 */
+	if (parent_dev)
+		g_object_ref (parent_dev);
+
 	/* Update active connection base class state */
 	nm_active_connection_set_state (NM_ACTIVE_CONNECTION (connection),
 	                                ac_state_from_vpn_state (vpn_state));
@@ -271,6 +277,8 @@ nm_vpn_connection_set_vpn_state (NMVPNConnection *connection,
 	}
 
 	g_object_unref (connection);
+	if (parent_dev)
+		g_object_unref (parent_dev);
 }
 
 static void