diff --git a/.gitignore b/.gitignore
index fe3f51eac..95a1b0493 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,10 @@ debugConfig.yaml
 .devcontainer/nats/resolver.conf
 .devcontainer/nsc
 
+# go work
+go.work
+go.work.sum
+
 # helm test
 test-output/
 
diff --git a/Makefile b/Makefile
index abcdc1e2c..6b27413ed 100644
--- a/Makefile
+++ b/Makefile
@@ -75,7 +75,7 @@ generate: background-run .generate kill-running ## Generates code
 go-run: ## Runs the app
 	@echo --- Running binary...
 	@date --rfc-3339=seconds
-	@go run main.go serve --dev
+	@go run main.go serve --dev --oidc=false
 
 background-run:  ## Runs in the app in the background
 	@date --rfc-3339=seconds
diff --git a/internal/manualhooks/hooks.go b/internal/manualhooks/hooks.go
index b95f89353..1bd12cc23 100644
--- a/internal/manualhooks/hooks.go
+++ b/internal/manualhooks/hooks.go
@@ -1007,30 +1007,26 @@ func PortHooks() []ent.Hook {
 					}
 
 					// Ensure we have additional relevant subjects in the event msg
-					addSubjPools, err := m.Client().Pool.Query().WithPorts(func(q *generated.PortQuery) {
-						q.WithLoadBalancer()
-					}).Where(pool.HasPortsWith(port.IDEQ(objID))).All(ctx)
+					addSubjPort, err := m.Client().Port.Query().WithPools().WithLoadBalancer().Where(port.IDEQ(objID)).Only(ctx)
 					if err == nil {
-						for _, pool := range addSubjPools {
-							for _, port := range pool.Edges.Ports {
-								if !slices.Contains(msg.AdditionalSubjectIDs, port.LoadBalancerID) {
-									msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, port.LoadBalancerID)
-								}
+						if !slices.Contains(msg.AdditionalSubjectIDs, addSubjPort.LoadBalancerID) {
+							msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, addSubjPort.LoadBalancerID)
+						}
 
-								if !slices.Contains(msg.AdditionalSubjectIDs, port.Edges.LoadBalancer.LocationID) {
-									msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, port.Edges.LoadBalancer.LocationID)
-								}
+						if !slices.Contains(msg.AdditionalSubjectIDs, addSubjPort.Edges.LoadBalancer.LocationID) {
+							msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, addSubjPort.Edges.LoadBalancer.LocationID)
+						}
 
-								if !slices.Contains(msg.AdditionalSubjectIDs, port.Edges.LoadBalancer.ProviderID) {
-									msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, port.Edges.LoadBalancer.ProviderID)
-								}
+						if !slices.Contains(msg.AdditionalSubjectIDs, addSubjPort.Edges.LoadBalancer.OwnerID) {
+							msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, addSubjPort.Edges.LoadBalancer.OwnerID)
+						}
 
-								if !slices.Contains(msg.AdditionalSubjectIDs, port.Edges.LoadBalancer.OwnerID) {
-									msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, port.Edges.LoadBalancer.OwnerID)
-								}
-							}
+						if !slices.Contains(msg.AdditionalSubjectIDs, addSubjPort.Edges.LoadBalancer.ProviderID) {
+							msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, addSubjPort.Edges.LoadBalancer.ProviderID)
+						}
 
-							if !slices.Contains(msg.AdditionalSubjectIDs, pool.ID) && objID != pool.ID {
+						for _, pool := range addSubjPort.Edges.Pools {
+							if !slices.Contains(msg.AdditionalSubjectIDs, pool.ID) {
 								msg.AdditionalSubjectIDs = append(msg.AdditionalSubjectIDs, pool.ID)
 							}
 
diff --git a/internal/manualhooks/hooks_test.go b/internal/manualhooks/hooks_test.go
index 4b6a9020b..bf9953079 100644
--- a/internal/manualhooks/hooks_test.go
+++ b/internal/manualhooks/hooks_test.go
@@ -282,23 +282,58 @@ func Test_PortCreateHook(t *testing.T) {
 	changesChannel, err := testutils.EventsConn.SubscribeChanges(ctx, "create.load-balancer-port")
 	require.NoError(t, err, "failed to subscribe to changes")
 
-	lb := (&testutils.LoadBalancerBuilder{}).MustNew(ctx)
-	pool := (&testutils.PoolBuilder{}).MustNew(ctx)
-
 	testutils.EntClient.Port.Use(manualhooks.PortHooks()...)
 
-	// Act
-	port := (&testutils.PortBuilder{PoolIDs: []gidx.PrefixedID{pool.ID}, LoadBalancerID: lb.ID}).MustNew(ctx)
+	t.Run("with pool", func(t *testing.T) {
+		// Act
+		lb := (&testutils.LoadBalancerBuilder{}).MustNew(ctx)
+		pool := (&testutils.PoolBuilder{OwnerID: lb.OwnerID}).MustNew(ctx)
+		port := (&testutils.PortBuilder{PoolIDs: []gidx.PrefixedID{pool.ID}, LoadBalancerID: lb.ID}).MustNew(ctx)
 
-	msg := testutils.ChannelReceiveWithTimeout[events.Message[events.ChangeMessage]](t, changesChannel, defaultTimeout)
+		msg := testutils.ChannelReceiveWithTimeout[events.Message[events.ChangeMessage]](t, changesChannel, defaultTimeout)
 
-	// Assert
-	expectedAdditionalSubjectIDs := []gidx.PrefixedID{pool.ID, pool.OwnerID, lb.ID, lb.LocationID, lb.ProviderID, lb.OwnerID}
-	actualAdditionalSubjectIDs := msg.Message().AdditionalSubjectIDs
+		// Assert
+		expectedAdditionalSubjectIDs := []gidx.PrefixedID{pool.ID, lb.ID, lb.LocationID, lb.ProviderID, lb.OwnerID}
+		actualAdditionalSubjectIDs := msg.Message().AdditionalSubjectIDs
 
-	assert.ElementsMatch(t, expectedAdditionalSubjectIDs, actualAdditionalSubjectIDs)
-	assert.Equal(t, port.ID, msg.Message().SubjectID)
-	assert.Equal(t, createEventType, msg.Message().EventType)
+		assert.ElementsMatch(t, expectedAdditionalSubjectIDs, actualAdditionalSubjectIDs)
+		assert.Equal(t, port.ID, msg.Message().SubjectID)
+		assert.Equal(t, createEventType, msg.Message().EventType)
+	})
+
+	t.Run("with multiple pools", func(t *testing.T) {
+		// Act
+		lb := (&testutils.LoadBalancerBuilder{}).MustNew(ctx)
+		pool := (&testutils.PoolBuilder{OwnerID: lb.OwnerID}).MustNew(ctx)
+		pool2 := (&testutils.PoolBuilder{OwnerID: lb.OwnerID}).MustNew(ctx)
+		port := (&testutils.PortBuilder{PoolIDs: []gidx.PrefixedID{pool.ID, pool2.ID}, LoadBalancerID: lb.ID}).MustNew(ctx)
+
+		msg := testutils.ChannelReceiveWithTimeout[events.Message[events.ChangeMessage]](t, changesChannel, defaultTimeout)
+
+		// Assert
+		expectedAdditionalSubjectIDs := []gidx.PrefixedID{pool.ID, pool2.ID, lb.ID, lb.LocationID, lb.ProviderID, lb.OwnerID}
+		actualAdditionalSubjectIDs := msg.Message().AdditionalSubjectIDs
+
+		assert.ElementsMatch(t, expectedAdditionalSubjectIDs, actualAdditionalSubjectIDs)
+		assert.Equal(t, port.ID, msg.Message().SubjectID)
+		assert.Equal(t, createEventType, msg.Message().EventType)
+	})
+
+	t.Run("with no pool", func(t *testing.T) {
+		// Act
+		lb := (&testutils.LoadBalancerBuilder{}).MustNew(ctx)
+		port := (&testutils.PortBuilder{PoolIDs: []gidx.PrefixedID{}, LoadBalancerID: lb.ID}).MustNew(ctx)
+
+		msg := testutils.ChannelReceiveWithTimeout[events.Message[events.ChangeMessage]](t, changesChannel, defaultTimeout)
+
+		// Assert
+		expectedAdditionalSubjectIDs := []gidx.PrefixedID{lb.ID, lb.LocationID, lb.ProviderID, lb.OwnerID}
+		actualAdditionalSubjectIDs := msg.Message().AdditionalSubjectIDs
+
+		assert.ElementsMatch(t, expectedAdditionalSubjectIDs, actualAdditionalSubjectIDs)
+		assert.Equal(t, port.ID, msg.Message().SubjectID)
+		assert.Equal(t, createEventType, msg.Message().EventType)
+	})
 }
 
 func Test_PortUpdateHook(t *testing.T) {