diff --git a/nix/vm.nix b/nix/vm.nix
--- a/nix/vm.nix
+++ b/nix/vm.nix
@@ -21,7 +21,7 @@
         g = config.services.tangled-knot.gitUser;
       in [
         "d /var/lib/knot 0770 ${u} ${g} - -" # Create the directory first
-        "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=7387221d57e64499b179a9dff19c5f1abf436470e2976d3585badddad5282970"
+        "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=168c426fa6d9829fcbe85c96bdf144e800fb9737d6ca87f21acc543b1aa3e440"
       ];
       services.tangled-knot = {
         enable = true;
diff --git a/spindle/server.go b/spindle/server.go
--- a/spindle/server.go
+++ b/spindle/server.go
@@ -218,17 +218,32 @@
 
 func (s *Spindle) configureOwner() error {
 	cfgOwner := s.cfg.Server.Owner
-	serverOwner, err := s.e.GetUserByRole("server:owner", rbacDomain)
+
+	existing, err := s.e.GetSpindleUsersByRole("server:owner", rbacDomain)
 	if err != nil {
-		return fmt.Errorf("failed to fetch server:owner: %w", err)
+		return err
 	}
 
-	if len(serverOwner) == 0 {
-		s.e.AddKnotOwner(rbacDomain, cfgOwner)
-	} else {
-		if serverOwner[0] != cfgOwner {
-			return fmt.Errorf("server owner mismatch: %s != %s", cfgOwner, serverOwner[0])
+	switch len(existing) {
+	case 0:
+		// no owner configured, continue
+	case 1:
+		// find existing owner
+		existingOwner := existing[0]
+
+		// no ownership change, this is okay
+		if existingOwner == s.cfg.Server.Owner {
+			break
 		}
+
+		// remove existing owner
+		err = s.e.RemoveSpindleOwner(rbacDomain, existingOwner)
+		if err != nil {
+			return nil
+		}
+	default:
+		return fmt.Errorf("more than one owner in DB, try deleting %q and starting over", s.cfg.Server.DBPath)
 	}
-	return nil
+
+	return s.e.AddSpindleOwner(rbacDomain, cfgOwner)
 }
diff --git a/appview/state/spindlestream.go b/appview/state/spindlestream.go
--- a/appview/state/spindlestream.go
+++ b/appview/state/spindlestream.go
@@ -20,7 +20,10 @@
 )
 
 func Spindlestream(ctx context.Context, c *config.Config, d *db.DB, enforcer *rbac.Enforcer) (*ec.Consumer, error) {
-	spindles, err := db.GetSpindles(d)
+	spindles, err := db.GetSpindles(
+		d,
+		db.FilterIsNot("verified", "null"),
+	)
 	if err != nil {
 		return nil, err
 	}