diff --git a/CHANGELOG.md b/CHANGELOG.md
index 09bedc1..d9d20d8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ## \[Unreleased\]
 
 ### Added
+- Admin Websocket call `revoke_agent_key` which revokes an agent key for an app and makes the source chains of the app read-only.
 ### Changed
 ### Fixed
 ### Removed
diff --git a/Cargo.lock b/Cargo.lock
index 2f34277..a62d355 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -96,9 +96,9 @@ dependencies = [
 
 [[package]]
 name = "aitia"
-version = "0.3.0-dev.3"
+version = "0.3.0-dev.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9931ae65299aa3623d7d5d671cf92aef6a4add0e0a38fd7914977e7e5d330f50"
+checksum = "cf586cb9185c985fd25a4fae5cf2e8e2f590dd7c60beffd9cc62da64ac80d16a"
 dependencies = [
  "anyhow",
  "derive_more",
@@ -812,12 +812,13 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.1.5"
+version = "1.1.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "324c74f2155653c90b04f25b2a47a8a631360cb908f92a772695f430c7e31052"
+checksum = "57b6a275aa2903740dc87da01c62040406b8812552e97129a63ea8850a17c6e6"
 dependencies = [
  "jobserver",
  "libc",
+ "shlex",
 ]
 
 [[package]]
@@ -2267,11 +2268,38 @@ dependencies = [
  "hashbrown 0.14.5",
 ]
 
+[[package]]
+name = "hc_deepkey_sdk"
+version = "0.7.0-dev.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7975ba6ea6fe556ca5fd8cdac601c13b64533c0b115af8473e220f90b1788bbd"
+dependencies = [
+ "arbitrary",
+ "hc_deepkey_types",
+ "hdk",
+ "serde",
+ "serde_bytes",
+]
+
+[[package]]
+name = "hc_deepkey_types"
+version = "0.8.0-dev.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719149000797d7a3d1ec9457719cf1ed412b8a6197bbdf01d1d3284fa68981f2"
+dependencies = [
+ "arbitrary",
+ "hdi",
+ "holo_hash",
+ "holochain_integrity_types",
+ "rmpv",
+ "serde",
+]
+
 [[package]]
 name = "hc_r2d2_sqlite"
-version = "0.24.0"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a95a4a8a02468f63e725a3881594a6720933f4e620087e5c2e34681d14cef05"
+checksum = "7f4044c2cadf3d960fa91a7ef91590da202797fe82cf687b029235f98be5ff49"
 dependencies = [
  "r2d2",
  "rusqlite",
@@ -2295,9 +2323,9 @@ dependencies = [
 
 [[package]]
 name = "hc_sleuth"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bba0468ff7ec7eb0279df4a0d6214b7073cb34c5686dc94bb6f65d447c5b564e"
+checksum = "7679f50fee40e1a46d66cb529ccba84e2adae4598082a02159bf2200189cdf97"
 dependencies = [
  "aitia",
  "anyhow",
@@ -2318,9 +2346,9 @@ dependencies = [
 
 [[package]]
 name = "hdi"
-version = "0.5.0-dev.10"
+version = "0.5.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9dd62de0d29f215642cb2481ec5cdde81233c3fabe97157c8a35118b69dd821d"
+checksum = "33d5d70abaf440c54d65c28cf2a9d1263bf6c5a78baa76f53ff4773350a4b220"
 dependencies = [
  "getrandom 0.2.15",
  "hdk_derive",
@@ -2336,9 +2364,9 @@ dependencies = [
 
 [[package]]
 name = "hdk"
-version = "0.4.0-dev.12"
+version = "0.4.0-dev.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d000c0be9deb5fa8bc111b42fd7085fccf7cc12bf67ae4c8ccf797dca1e866c"
+checksum = "ae6e77c7d571f068070cabb5ebe12321da48918d81076708568a1ef3c4294154"
 dependencies = [
  "getrandom 0.2.15",
  "hdi",
@@ -2356,9 +2384,9 @@ dependencies = [
 
 [[package]]
 name = "hdk_derive"
-version = "0.4.0-dev.10"
+version = "0.4.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbfd717793514df9e0c44d698e820e68692792fa38c2d721c97c201e5376476e"
+checksum = "85905fbb6eb33b6da346f5d7b6b1b16b85c15d57b3fd2d0ed3e94dd78777c1b3"
 dependencies = [
  "darling 0.14.4",
  "heck 0.5.0",
@@ -2459,9 +2487,9 @@ dependencies = [
 
 [[package]]
 name = "holo_hash"
-version = "0.4.0-dev.9"
+version = "0.4.0-dev.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51425a83caa336a4bd8e6bf4f9b0374ee315fcf4b4c7a103aa2e0c54bb872cad"
+checksum = "8f168530890ae501c964763d6bfdd92c3d4c633b643a909704f99929c9112205"
 dependencies = [
  "arbitrary",
  "base64 0.22.1",
@@ -2485,9 +2513,9 @@ dependencies = [
 
 [[package]]
 name = "holochain"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3046ebc4fcf6b50e75885bd9a328496efe1c49ee2aad0ca9d7fd2b516d00e4be"
+checksum = "e07337f8296b102b56ede8c701fa5598c7d93a977a0ca388316880a856825b9d"
 dependencies = [
  "aitia",
  "anyhow",
@@ -2508,12 +2536,14 @@ dependencies = [
  "get_if_addrs",
  "getrandom 0.2.15",
  "ghost_actor",
+ "hc_deepkey_sdk",
  "hc_sleuth",
  "hdk",
  "holo_hash",
  "holochain_cascade",
  "holochain_conductor_api",
  "holochain_conductor_services",
+ "holochain_deepkey_dna",
  "holochain_keystore",
  "holochain_metrics",
  "holochain_nonce",
@@ -2542,6 +2572,7 @@ dependencies = [
  "matches",
  "mockall",
  "mr_bundle",
+ "must_future",
  "nanoid",
  "once_cell",
  "one_err",
@@ -2585,9 +2616,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_cascade"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d57472b0073c2ec06e64a29b5821ef3d4e2964acfc777d48f4b0c1371bfc35"
+checksum = "279080553b66a06578b61ba7a7615a7eb4b7e35d7619d5cfd6b2ae303434e316"
 dependencies = [
  "async-trait",
  "fixt",
@@ -2629,7 +2660,7 @@ dependencies = [
  "holochain_websocket",
  "holochain_zome_types",
  "kitsune_p2p_types",
- "lair_keystore_api",
+ "lair_keystore_api 0.4.5",
  "parking_lot 0.12.3",
  "rand 0.8.5",
  "serde",
@@ -2638,9 +2669,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_conductor_api"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea9c7aaa2e3cd5e10192b35bd30aa9032b41349f56d6fb324828495596a3a627"
+checksum = "6020a5641ceb344b8e93847cdb2dd42e73945f02463f3283eaf36958e17e0e12"
 dependencies = [
  "derive_more",
  "holo_hash",
@@ -2661,25 +2692,41 @@ dependencies = [
 
 [[package]]
 name = "holochain_conductor_services"
-version = "0.3.0-dev.18"
+version = "0.3.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "873ecbaae0efbe3a67a010e5bcc04dd466d7696a0a48e1609ea99f7d3235dc54"
+checksum = "7a6921e270536122da8d70cec151329810d56fe0fd6c5e8eea42b746faccf64d"
 dependencies = [
  "anyhow",
+ "arbitrary",
  "async-trait",
  "derive_more",
  "futures",
+ "hc_deepkey_sdk",
+ "holochain_deepkey_dna",
  "holochain_keystore",
  "holochain_types",
+ "holochain_util",
  "mockall",
+ "must_future",
+ "nanoid",
+ "serde",
+ "serde_bytes",
  "thiserror",
+ "tokio",
+ "tracing",
 ]
 
+[[package]]
+name = "holochain_deepkey_dna"
+version = "0.0.8-dev.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e1dc5e04f2f9d0f37f90736e91a5034511136a5dcf8891a04debdf8a522cdf"
+
 [[package]]
 name = "holochain_integrity_types"
-version = "0.4.0-dev.10"
+version = "0.4.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12e2d557cc479814090f4724264880ee7ee5e31e5009c98fe23fcc07857ff724"
+checksum = "d15fab21e6eab0af97cd1bb30494fe423b3740c438caf7bbda12e47979c926ea"
 dependencies = [
  "arbitrary",
  "derive_builder 0.20.0",
@@ -2699,9 +2746,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_keystore"
-version = "0.4.0-dev.16"
+version = "0.4.0-dev.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f303489615e9e501b354ffe42ee0a2097357e7606f685cd40cb778a8b01f6a61"
+checksum = "8bdd2a568cb8594340eab2dcbbd0c9b4817ca882648a975c5396401bcc125a41"
 dependencies = [
  "base64 0.22.1",
  "derive_more",
@@ -2739,9 +2786,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_nonce"
-version = "0.4.0-dev.4"
+version = "0.4.0-dev.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d338a69a1d074d7ecc58e028bd3962c98741f5448830b0dcf7a853bbb6515f0"
+checksum = "8fca689af4b640f52849faa1d79387810eb97cfe0e96175febccecaf82bd3261"
 dependencies = [
  "getrandom 0.2.15",
  "holochain_secure_primitive",
@@ -2750,9 +2797,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_p2p"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9749e3a496af6ad8343d0547ee78363eb748a983d1637bd7a6b6ee8b98fb404"
+checksum = "86140a90d334d6ed98da46ac0bb17aa5a3b33754d6b65f345308f49293719edc"
 dependencies = [
  "aitia",
  "async-trait",
@@ -2821,12 +2868,13 @@ dependencies = [
 
 [[package]]
 name = "holochain_sqlite"
-version = "0.4.0-dev.16"
+version = "0.4.0-dev.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c16598bee58cfd58ae6d6e07d5f79f840f11db507b0e436bbd46ef19d2a4c72c"
+checksum = "a23211339c7d528359bdc3e0effd9f3e9bd706c57ba10e36576377aa28c16005"
 dependencies = [
  "anyhow",
  "async-trait",
+ "base64 0.22.1",
  "derive_more",
  "fallible-iterator 0.3.0",
  "futures",
@@ -2855,6 +2903,7 @@ dependencies = [
  "serde",
  "serde_json",
  "shrinkwraprs",
+ "sodoken 0.0.11",
  "sqlformat",
  "tempfile",
  "thiserror",
@@ -2864,9 +2913,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_state"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15a8ea59d87828dd607f915d2f38e466e95d0cd6705356821658c6a1f49b9d7"
+checksum = "d2fc2dea1c37d0f3fd2b4db3185f28352802d5d89d2a40241735ae370f782444"
 dependencies = [
  "aitia",
  "async-recursion",
@@ -2901,9 +2950,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_state_types"
-version = "0.4.0-dev.10"
+version = "0.4.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5c889f7234110e0b2328c454d4d1a57281e7bbfbe1252ac1ac78dc71eab2dc0"
+checksum = "9fb6a729e02c4bcc3c32227a705d8ca5f984229018cb3b380439395fce7fae8c"
 dependencies = [
  "holo_hash",
  "holochain_integrity_types",
@@ -2912,9 +2961,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_test_wasm_common"
-version = "0.4.0-dev.12"
+version = "0.4.0-dev.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5edf2524d8270eb118fb8c1ba93edcb42674c7d529d62b1e87ade0b9b2307ea4"
+checksum = "e9615c91b641f15580765a06dae913e7318b298edbfddb5759a599fdce3791ef"
 dependencies = [
  "hdk",
  "serde",
@@ -2922,9 +2971,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_trace"
-version = "0.4.0-dev.3"
+version = "0.4.0-dev.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e893ff1a7709195c73ad47dd5329ec9c96280743cdc2a92917709a626c34195"
+checksum = "f3e00bdd969d61fab25573441a201ee8da89d34df655b4153e1d092e54dca29a"
 dependencies = [
  "chrono",
  "derive_more",
@@ -2940,15 +2989,18 @@ dependencies = [
 
 [[package]]
 name = "holochain_types"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ea58298b002ecbd20b5160b19516604e393734ecc1952594ac76162ffcfcf8d"
+checksum = "a981b13f06ef43203bb71c296b7986f492cdf43342f467d72b602b1e2bc89d69"
 dependencies = [
  "anyhow",
  "arbitrary",
  "async-trait",
  "automap",
  "backtrace",
+ "base64 0.13.1",
+ "cfg-if 0.1.10",
+ "chrono",
  "contrafact",
  "derive_builder 0.20.0",
  "derive_more",
@@ -2956,6 +3008,7 @@ dependencies = [
  "flate2",
  "futures",
  "getrandom 0.2.15",
+ "hc_deepkey_sdk",
  "holo_hash",
  "holochain_keystore",
  "holochain_nonce",
@@ -2994,9 +3047,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_util"
-version = "0.4.0-dev.2"
+version = "0.4.0-dev.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79b89c3542e1fe783d9505d14a83497abadcf84d5d87e73fe1dbff3ac21cfce8"
+checksum = "ac1c491b6ba90c68041b393264b1e67c2990b68094caa7fdfe1ea5a959c82107"
 dependencies = [
  "backtrace",
  "cfg-if 1.0.0",
@@ -3012,9 +3065,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_wasm_test_utils"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c8a5eb2ec5267590b5ab53bef7232c06c5397e1946000e3fa32f8bbd7352db0"
+checksum = "fdfbb8dd04e37d9ea4a8e8756dad13e46aa492db527388ed728371c3d6ed682a"
 dependencies = [
  "holochain_types",
  "holochain_util",
@@ -3073,9 +3126,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_websocket"
-version = "0.4.0-dev.18"
+version = "0.4.0-dev.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "269186f9ba9357be566b86d94bfc32b534fbe76bf42ae75ca991796ce70426b8"
+checksum = "51223ee2d05d4a60efeaba615f14ede370a4c2d5a9eeb26bd4b4c9cac15bf641"
 dependencies = [
  "async-trait",
  "futures",
@@ -3090,9 +3143,9 @@ dependencies = [
 
 [[package]]
 name = "holochain_zome_types"
-version = "0.4.0-dev.12"
+version = "0.4.0-dev.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71794e55ee4a1d0315e0963c6b5f78a6f97b9ce28de211fed50d37efd284beb2"
+checksum = "7afab9dfd51b9feae14626b286284f4bc9f9d1139abc8d7d37fb1cfbf3ed74af"
 dependencies = [
  "arbitrary",
  "contrafact",
@@ -3714,9 +3767,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p"
-version = "0.4.0-dev.17"
+version = "0.4.0-dev.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e58e66a6449f845d48e94a7788f5296a1b5ffe895fac7ae38c116080bb52bfe"
+checksum = "db66f3fcc82d9af5bc2fb23a5096501f34e3e5f939c7ae8f3c33519d42327ae7"
 dependencies = [
  "arrayref",
  "base64 0.22.1",
@@ -3760,9 +3813,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_bin_data"
-version = "0.4.0-dev.9"
+version = "0.4.0-dev.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82a36538316e8289894aef8b60b857ea3d05fc8cb447c3bac45f0b22aa9901ce"
+checksum = "d5bc477873f3c25e263946caa431f236dec465d4c7c75a715bdf41cc87f45013"
 dependencies = [
  "arbitrary",
  "base64 0.22.1",
@@ -3779,9 +3832,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_block"
-version = "0.4.0-dev.9"
+version = "0.4.0-dev.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9caf6d341d99e05c0d1261632d8667f27bad5243889a9675865c6ebce8be975a"
+checksum = "cb37277cef33bacf6113448c8c224296c3ceb25ce1c72eca7911984f0bff0d65"
 dependencies = [
  "kitsune_p2p_bin_data",
  "kitsune_p2p_timestamp",
@@ -3790,9 +3843,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_bootstrap"
-version = "0.3.0-dev.11"
+version = "0.3.0-dev.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90a648ea247a1a98e4f76c5a76dacd2d625a98e8587e6fcfdf72df33af082e56"
+checksum = "33224f105c4468e2daa01d1ecb55f4dcfe16ecfad63fe2a07a79edf8632db551"
 dependencies = [
  "clap 4.5.9",
  "futures",
@@ -3810,9 +3863,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_bootstrap_client"
-version = "0.4.0-dev.11"
+version = "0.4.0-dev.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "752ed3ab3b2b3f0476bde2608bdbfa9e6b3bebe1b62f744b2bad3f2da05aff67"
+checksum = "c771d5fddc2df2b879a70ac7c7af45c8ae14417f9aa1788f3907418072d7f350"
 dependencies = [
  "kitsune_p2p_bin_data",
  "kitsune_p2p_bootstrap",
@@ -3825,9 +3878,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_dht"
-version = "0.4.0-dev.7"
+version = "0.4.0-dev.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b257c121606739785c4703d4db69cd0d91d7b0b5672462e9bdc373e51ad9880"
+checksum = "724960e037263eca03dad008d68a28fcab20f14a7a93a6572ff9c2743becdb1a"
 dependencies = [
  "arbitrary",
  "colored",
@@ -3849,9 +3902,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_dht_arc"
-version = "0.4.0-dev.7"
+version = "0.4.0-dev.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "241ded259c121ee17b34f95c81f6b0a11e3d28f379486c47b089102698a83556"
+checksum = "49cefd7f1867eb14ade8fce5b6a9975c399780f4735aad7701ed1b2036b72ae9"
 dependencies = [
  "arbitrary",
  "derive_more",
@@ -3867,9 +3920,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_fetch"
-version = "0.4.0-dev.10"
+version = "0.4.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f27059a6bdeb1ba89e0acba55b1b446f92642a4ac756c1374c7eb7eb4ae95b66"
+checksum = "d528b0c488562552bbed8fe1fb9f8d7af1b0670e986e2827156bd0b40ca27d01"
 dependencies = [
  "backon",
  "derive_more",
@@ -3898,9 +3951,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_proxy"
-version = "0.4.0-dev.10"
+version = "0.4.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9465de373e50eb86c80ab0f4dfcaf5a338838a36b6110c2d29b8df60f36af331"
+checksum = "bf591fab44b5f4780320793753ef63f1a323b0123a35080ee79d9ecfa3d4a2da"
 dependencies = [
  "base64 0.22.1",
  "derive_more",
@@ -3915,9 +3968,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_timestamp"
-version = "0.4.0-dev.2"
+version = "0.4.0-dev.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f75c6b5bdc4e3a9514c949975ab2a68f977e612bb638bd961ccab948d134af7a"
+checksum = "27e44de630f9a0c27edb0c123d12cafe09d3b719845f966c742e9b2043efea07"
 dependencies = [
  "arbitrary",
  "chrono",
@@ -3931,9 +3984,9 @@ dependencies = [
 
 [[package]]
 name = "kitsune_p2p_types"
-version = "0.4.0-dev.10"
+version = "0.4.0-dev.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09deead5dc56d687ec18186450d0f752154bae8625e4b84c3878bfc3b909fed4"
+checksum = "e166b2e7390b1791ceafecc14731d786881a1fd836712207926db2c144ac0172"
 dependencies = [
  "arbitrary",
  "base64 0.22.1",
@@ -3946,7 +3999,7 @@ dependencies = [
  "kitsune_p2p_dht",
  "kitsune_p2p_dht_arc",
  "kitsune_p2p_timestamp",
- "lair_keystore_api",
+ "lair_keystore_api 0.5.0",
  "mockall",
  "once_cell",
  "parking_lot 0.12.3",
@@ -3976,11 +4029,11 @@ dependencies = [
 
 [[package]]
 name = "lair_keystore"
-version = "0.4.5"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0da3e3e1bd2644dc2974ef622743cd83f2c661b3c6c67acb00cda4725646def"
+checksum = "db43da034583683b3a25d473e6024c7f529c31115418a7b95e609d5b0f090e5b"
 dependencies = [
- "lair_keystore_api",
+ "lair_keystore_api 0.5.0",
  "pretty_assertions",
  "rpassword",
  "rusqlite",
@@ -4016,6 +4069,32 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "lair_keystore_api"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2da1e0069976825273a8ba0e36b09785dc83812a9b0cf2c5eef3d85351534592"
+dependencies = [
+ "base64 0.22.1",
+ "dunce",
+ "hc_seed_bundle",
+ "lru",
+ "nanoid",
+ "once_cell",
+ "parking_lot 0.12.3",
+ "rcgen",
+ "serde",
+ "serde_json",
+ "serde_yaml",
+ "time",
+ "tokio",
+ "toml 0.8.15",
+ "tracing",
+ "url",
+ "winapi 0.3.9",
+ "zeroize",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -4123,9 +4202,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.28.0"
+version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c10584274047cb335c23d3e61bcef8e323adae7c5c8c760540f73610177fc3f"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
 dependencies = [
  "cc",
  "openssl-sys",
@@ -4391,9 +4470,9 @@ checksum = "7843ec2de400bcbc6a6328c958dc38e5359da6e93e72e37bc5246bf1ae776389"
 
 [[package]]
 name = "mr_bundle"
-version = "0.4.0-dev.5"
+version = "0.4.0-dev.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecba74b5293658685ec724bbe6baced8b4ff86e7bbea69a787de085d1f90b38d"
+checksum = "bec8cf33890b9d37580b77210cf52adc23b7a6528eaeb780b91c982374a19343"
 dependencies = [
  "arbitrary",
  "derive_more",
@@ -4774,9 +4853,9 @@ dependencies = [
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.102"
+version = "0.9.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c597637d56fbc83893a35eb0dd04b2b8e7a50c91e64e9493e398b5df4fb45fa2"
+checksum = "7f9e8deee91df40a943c71b917e5874b951d32a802526c85721ce3b776c929d6"
 dependencies = [
  "cc",
  "libc",
@@ -5861,9 +5940,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.31.0"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b838eba278d213a8beaf485bd313fd580ca4505a00d5871caeb1457c55322cae"
+checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
 dependencies = [
  "bitflags 2.6.0",
  "fallible-iterator 0.3.0",
@@ -6438,6 +6517,12 @@ dependencies = [
  "memmap2 0.6.2",
 ]
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "shrinkwraprs"
 version = "0.3.0"
diff --git a/Cargo.toml b/Cargo.toml
index ab36c7e..c7e924e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,7 @@ version = "0.6.0-dev.5"
 members = ["fixture/zomes/foo"]
 
 [workspace.dependencies]
-holochain_zome_types = "0.4.0-dev.10"
+holochain_zome_types = "0.4.0-dev.14"
 
 [dependencies]
 again = "0.1"
@@ -27,12 +27,12 @@ rand = { version = "0.8" }
 async-trait = "0.1"
 parking_lot = "0.12.1"
 
-holo_hash = { version = "0.4.0-dev.8", features = ["encoding"] }
-holochain_conductor_api = "0.4.0-dev.18"
-holochain_websocket = "0.4.0-dev.16"
+holo_hash = { version = "0.4.0-dev.11", features = ["encoding"] }
+holochain_conductor_api = "0.4.0-dev.20"
+holochain_websocket = "0.4.0-dev.19"
 holochain_serialized_bytes = "0.0.55"
-holochain_types = "0.4.0-dev.18"
-holochain_nonce = "0.4.0-dev.4"
+holochain_types = "0.4.0-dev.20"
+holochain_nonce = "0.4.0-dev.6"
 holochain_zome_types = { workspace = true }
 
 lair_keystore_api = { version = "0.4.5", optional = true }
@@ -41,9 +41,9 @@ tokio = { version = "1.36", features = ["rt"] }
 
 [dev-dependencies]
 arbitrary = "1.2"
-holochain = { version = "0.4.0-dev.18", features = ["test_utils"] }
+holochain = { version = "0.4.0-dev.20", features = ["test_utils"] }
 rand = "0.8"
-kitsune_p2p_types = "0.4.0-dev.9"
+kitsune_p2p_types = "0.4.0-dev.12"
 
 [features]
 default = ["lair_signing"]
diff --git a/flake.lock b/flake.lock
index 9bf3919..23542a3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721058578,
-        "narHash": "sha256-fs/PVa3H5dS1//4BjecWi3nitXm5fRObx0JxXIAo+JA=",
+        "lastModified": 1724377159,
+        "narHash": "sha256-ixjje1JO8ucKT41hs6n2NCde1Vc0+Zc2p2gUbJpCsMw=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "17e5109bb1d9fb393d70fba80988f7d70d1ded1a",
+        "rev": "3e47b7a86c19142bd3675da49d6acef488b4dac1",
         "type": "github"
       },
       "original": {
@@ -26,11 +26,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1719994518,
-        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
+        "lastModified": 1722555600,
+        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
+        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
         "type": "github"
       },
       "original": {
@@ -59,11 +59,11 @@
     "hc-scaffold": {
       "flake": false,
       "locked": {
-        "lastModified": 1723558677,
-        "narHash": "sha256-s5WjtXlu8d7U/zY2Kv4daaH0TlSiVc+D+UqR6B7+qj4=",
+        "lastModified": 1724063689,
+        "narHash": "sha256-OJOf55lwbIYnr1GbMGBYkgYFkNe/Aw4+MchQtos7RcU=",
         "owner": "holochain",
         "repo": "scaffolding",
-        "rev": "80edba8c2f5512ba0babcc8d84b78c1d79f0d1d8",
+        "rev": "3a9849020d4c525d200cf5675eeb2cb0923edd01",
         "type": "github"
       },
       "original": {
@@ -76,16 +76,16 @@
     "holochain": {
       "flake": false,
       "locked": {
-        "lastModified": 1723718736,
-        "narHash": "sha256-f8Hi7HvANahU5lJjtWk+XpnCcIjfMiV0yFxGqzqEXqU=",
+        "lastModified": 1724408854,
+        "narHash": "sha256-sWA4dKp92TPDVuOS2wHTaqXdXUWYPFnsbSobUtgpluM=",
         "owner": "holochain",
         "repo": "holochain",
-        "rev": "a3384305850735b1b71fa0ab6f36f2318ec56d28",
+        "rev": "89e195974eb4bec05a8215adb7029923f2fac6af",
         "type": "github"
       },
       "original": {
         "owner": "holochain",
-        "ref": "holochain-0.4.0-dev.18",
+        "ref": "holochain-0.4.0-dev.20",
         "repo": "holochain",
         "type": "github"
       }
@@ -102,11 +102,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1723737493,
-        "narHash": "sha256-zP22A91tT/i+chslSATQvjKrZTXelwTcDqeNTLLTcyc=",
+        "lastModified": 1724433732,
+        "narHash": "sha256-yAKkDz3DUcYARra9bTKPD6QIjBCBfBJBAVrdJs4hsKU=",
         "owner": "holochain",
         "repo": "holonix",
-        "rev": "6438098657b9441e65db1543f0200f22453238de",
+        "rev": "a0b6e1c0e2d7d10c103a0e65e1ba4ff61abfd2b7",
         "type": "github"
       },
       "original": {
@@ -119,16 +119,16 @@
     "lair-keystore": {
       "flake": false,
       "locked": {
-        "lastModified": 1717684904,
-        "narHash": "sha256-vcXt67Tl1qwVUkx8CBevdQocqZXUEeoXjaYw86ljsYo=",
+        "lastModified": 1724340490,
+        "narHash": "sha256-zKcYTefiJaDkgNLhH7bUEmL6j1QfiSNCK/hwBv9/Hxs=",
         "owner": "holochain",
         "repo": "lair",
-        "rev": "6a84ed490fc7074d107e38bbb4a8d707e9b8e066",
+        "rev": "70e2bd906af7f757cc03ac54b257df884b442ae8",
         "type": "github"
       },
       "original": {
         "owner": "holochain",
-        "ref": "lair_keystore-v0.4.5",
+        "ref": "lair_keystore-v0.5.0",
         "repo": "lair",
         "type": "github"
       }
@@ -151,14 +151,14 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1719876945,
-        "narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=",
+        "lastModified": 1722555339,
+        "narHash": "sha256-uFf2QeW7eAHlYXuDktm9c25OxOyCoUOQmh5SZ9amE5Q=",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+        "url": "https://github.com/NixOS/nixpkgs/archive/a5d394176e64ab29c852d03346c1fc9b0b7d33eb.tar.gz"
       }
     },
     "root": {
@@ -178,11 +178,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1721269159,
-        "narHash": "sha256-eHrGuKZKQb762qdCkrfoyyxXLKumYhiXJca1ig0RftE=",
+        "lastModified": 1724379657,
+        "narHash": "sha256-+CFDh1FUgyY7q0FiWhKJpHS7LlD3KbiqN5Z4Z+4bGmc=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "c3e217122ac55680606d69bc693bdf262f14f602",
+        "rev": "a18034322c7703fcfe5d7352a77981ba4a936a61",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 2a32f3e..f2c2e01 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,6 +1,6 @@
 {
   inputs = {
-    holonix.url = "github:holochain/holonix/main";
+    holonix.url = "github:holochain/holonix?ref=main";
     nixpkgs.follows = "holonix/nixpkgs";
   };
 
diff --git a/src/admin_websocket.rs b/src/admin_websocket.rs
index 0d6f033..fec320e 100644
--- a/src/admin_websocket.rs
+++ b/src/admin_websocket.rs
@@ -3,7 +3,8 @@ use anyhow::Result;
 use holo_hash::DnaHash;
 use holochain_conductor_api::{
     AdminRequest, AdminResponse, AppAuthenticationTokenIssued, AppInfo, AppInterfaceInfo,
-    AppStatusFilter, CompatibleCells, IssueAppAuthenticationTokenPayload, StorageInfo,
+    AppStatusFilter, CompatibleCells, IssueAppAuthenticationTokenPayload, RevokeAgentKeyPayload,
+    StorageInfo,
 };
 use holochain_types::websocket::AllowedOrigins;
 use holochain_types::{
@@ -101,6 +102,22 @@ impl AdminWebsocket {
         }
     }
 
+    pub async fn revoke_agent_key(
+        &self,
+        app_id: String,
+        agent_key: AgentPubKey,
+    ) -> ConductorApiResult<Vec<(CellId, String)>> {
+        let response = self
+            .send(AdminRequest::RevokeAgentKey(Box::new(
+                RevokeAgentKeyPayload { app_id, agent_key },
+            )))
+            .await?;
+        match response {
+            AdminResponse::AgentKeyRevoked(errors) => Ok(errors),
+            _ => unreachable!("Unexpected response {:?}", response),
+        }
+    }
+
     /// List all app interfaces attached to the conductor.
     ///
     /// See the documentation for [AdminWebsocket::attach_app_interface] to understand the content
diff --git a/tests/admin.rs b/tests/admin.rs
index 6390f20..0f35c09 100644
--- a/tests/admin.rs
+++ b/tests/admin.rs
@@ -40,10 +40,9 @@ async fn signed_zome_call() {
 
     // Set up the test app
     let app_id: InstalledAppId = "test-app".into();
-    let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     let installed_app = admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: None,
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -119,7 +118,7 @@ async fn storage_info() {
     let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: Some(agent_key.clone()),
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -154,7 +153,7 @@ async fn dump_network_stats() {
     let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: Some(agent_key.clone()),
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -182,7 +181,7 @@ async fn get_compatible_cells() {
     let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     let app_info = admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: Some(agent_key.clone()),
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -215,3 +214,46 @@ async fn get_compatible_cells() {
         "only cell should be expected app cell"
     );
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn revoke_agent_key() {
+    let conductor = SweetConductor::from_standard_config().await;
+    let admin_port = conductor.get_arbitrary_admin_websocket_port().unwrap();
+    let admin_ws = AdminWebsocket::connect(format!("127.0.0.1:{}", admin_port))
+        .await
+        .unwrap();
+
+    let app_info = admin_ws
+        .install_app(InstallAppPayload {
+            agent_key: None,
+            installed_app_id: None,
+            membrane_proofs: None,
+            network_seed: None,
+            existing_cells: HashMap::new(),
+            source: AppBundleSource::Path(PathBuf::from("./fixture/test.happ")),
+            ignore_genesis_failure: false,
+        })
+        .await
+        .unwrap();
+    let app_id = app_info.installed_app_id.clone();
+    admin_ws.enable_app(app_id.clone()).await.unwrap();
+
+    let agent_key = app_info.agent_pub_key.clone();
+    let response = admin_ws
+        .revoke_agent_key(app_id.clone(), agent_key.clone())
+        .await
+        .unwrap();
+    assert_eq!(response, vec![]);
+    let response = admin_ws
+        .revoke_agent_key(app_id, agent_key.clone())
+        .await
+        .unwrap();
+    let cell_id = if let CellInfo::Provisioned(provisioned_cell) =
+        &app_info.cell_info.get(ROLE_NAME).unwrap()[0]
+    {
+        provisioned_cell.cell_id.clone()
+    } else {
+        panic!("expected provisioned cell")
+    };
+    assert!(matches!(&response[0], (cell, error) if *cell == cell_id && error.contains("invalid")));
+}
diff --git a/tests/app.rs b/tests/app.rs
index 35c5cfc..f10ef32 100644
--- a/tests/app.rs
+++ b/tests/app.rs
@@ -36,7 +36,7 @@ async fn network_info() {
     let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     let app_info = admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: Some(agent_key.clone()),
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -108,10 +108,9 @@ async fn handle_signal() {
 
     // Set up the test app
     let app_id: InstalledAppId = "test-app".into();
-    let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: None,
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -206,10 +205,9 @@ async fn close_on_drop_is_clone_safe() {
 
     // Set up the test app
     let app_id: InstalledAppId = "test-app".into();
-    let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
     let app_info = admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: None,
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -258,7 +256,6 @@ async fn deferred_memproof_installation() {
         .await
         .unwrap();
     let app_id: InstalledAppId = "test-app".into();
-    let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
 
     // Modify app bundle to enable deferred membrane proofs.
     let app_bundle_source = AppBundleSource::Path(PathBuf::from("./fixture/test.happ"));
@@ -278,7 +275,7 @@ async fn deferred_memproof_installation() {
 
     admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: None,
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
diff --git a/tests/clone_cell.rs b/tests/clone_cell.rs
index f029c34..2e4f42b 100644
--- a/tests/clone_cell.rs
+++ b/tests/clone_cell.rs
@@ -28,10 +28,9 @@ async fn clone_cell_management() {
     // Set up the test app
     let app_id: InstalledAppId = "test-app".into();
     let role_name: RoleName = "foo".into();
-    let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
-    admin_ws
+    let app_info = admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: None,
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,
@@ -71,7 +70,7 @@ async fn clone_cell_management() {
             })
             .await
             .unwrap();
-        assert_eq!(*clone_cell.cell_id.agent_pubkey(), agent_key);
+        assert_eq!(*clone_cell.cell_id.agent_pubkey(), app_info.agent_pub_key);
         assert_eq!(clone_cell.clone_id, CloneId::new(&role_name, 0));
         clone_cell
     };
@@ -153,11 +152,11 @@ async fn clone_cell_management() {
     admin_ws
         .delete_clone_cell(DeleteCloneCellPayload {
             app_id: app_id.clone(),
-            clone_cell_id: CloneCellId::CellId(clone_cell.clone().cell_id),
+            clone_cell_id: CloneCellId::DnaHash(clone_cell.cell_id.dna_hash().clone()),
         })
         .await
         .unwrap();
-    // restore deleted clone cells should fail
+    // restore deleted clone cell should fail
     let enable_clone_cell_response = app_ws
         .enable_clone_cell(EnableCloneCellPayload {
             clone_cell_id: CloneCellId::CloneId(clone_cell.clone_id),
@@ -180,13 +179,10 @@ pub async fn app_info_refresh() {
     let app_id: InstalledAppId = "test-app".into();
     let role_name: RoleName = "foo".into();
 
-    // Create our agent key
-    let agent_key = admin_ws.generate_agent_pub_key().await.unwrap();
-
     // Install and enable an app
     admin_ws
         .install_app(InstallAppPayload {
-            agent_key: agent_key.clone(),
+            agent_key: None,
             installed_app_id: Some(app_id.clone()),
             membrane_proofs: None,
             network_seed: None,