diff --git a/libfwupdplugin/fu-device.c b/libfwupdplugin/fu-device.c
index 112246c02..c8a28246f 100644
--- a/libfwupdplugin/fu-device.c
+++ b/libfwupdplugin/fu-device.c
@@ -2270,6 +2270,13 @@ fu_device_add_flag (FuDevice *self, FwupdDeviceFlags flag)
 	if (flag & FWUPD_DEVICE_FLAG_INSTALL_ALL_RELEASES)
 		flag |= FWUPD_DEVICE_FLAG_VERSION_CHECK_REQUIRED;
 	fwupd_device_add_flag (FWUPD_DEVICE (self), flag);
+
+	/* activatable devices shouldn't be allowed to update again until activated */
+	/* don't let devices be updated until activated */
+	if (flag & FWUPD_DEVICE_FLAG_NEEDS_ACTIVATION) {
+		fwupd_device_remove_flag (FWUPD_DEVICE (self), FWUPD_DEVICE_FLAG_UPDATABLE);
+		fwupd_device_add_flag (FWUPD_DEVICE (self), FWUPD_DEVICE_FLAG_UPDATABLE_HIDDEN);
+	}
 }
 
 static void
diff --git a/libfwupdplugin/fu-plugin.c b/libfwupdplugin/fu-plugin.c
index 919a29965..3327de8c3 100644
--- a/libfwupdplugin/fu-plugin.c
+++ b/libfwupdplugin/fu-plugin.c
@@ -2312,6 +2312,12 @@ fu_plugin_runner_activate (FuPlugin *self, FuDevice *device, GError **error)
 
 	/* update with correct flags */
 	fu_device_remove_flag (device, FWUPD_DEVICE_FLAG_NEEDS_ACTIVATION);
+
+	/* allow it to be updatable again */
+	if (fu_device_has_flag (device, FWUPD_DEVICE_FLAG_UPDATABLE_HIDDEN)) {
+		fu_device_remove_flag (device, FWUPD_DEVICE_FLAG_UPDATABLE_HIDDEN);
+		fu_device_add_flag (device, FWUPD_DEVICE_FLAG_UPDATABLE);
+	}
 	fu_device_set_modified (device, (guint64) g_get_real_time () / G_USEC_PER_SEC);
 	return TRUE;
 }