diff --git a/controller/DBMirrorSet.cpp b/controller/DBMirrorSet.cpp
index f15d393c0..cf1f02194 100644
--- a/controller/DBMirrorSet.cpp
+++ b/controller/DBMirrorSet.cpp
@@ -240,9 +240,8 @@ void DBMirrorSet::onNetworkMemberDeauthorize(const void *db,uint64_t networkId,u
 	_listener->onNetworkMemberDeauthorize(this,networkId,memberId);
 }
 
-std::set< std::pair<uint64_t, uint64_t> > DBMirrorSet::membersExpiringSoon()
+void DBMirrorSet::membersExpiring(std::set< std::pair<uint64_t, uint64_t> > &soon, std::set< std::pair<uint64_t, uint64_t> > &expired)
 {
-	std::set< std::pair<uint64_t, uint64_t> > soon;
 	std::unique_lock<std::mutex> l(_membersExpiringSoon_l);
 	int64_t now = OSUtils::now();
 	for(auto next=_membersExpiringSoon.begin();next!=_membersExpiringSoon.end();) {
@@ -276,10 +275,9 @@ std::set< std::pair<uint64_t, uint64_t> > DBMirrorSet::membersExpiringSoon()
 		}
 		_membersExpiringSoon.erase(next++);
 	}
-	return soon;
 }
 
-void DBMirrorSet::memberExpiring(int64_t expTime, uint64_t nwid, uint64_t memberId)
+void DBMirrorSet::memberWillExpire(int64_t expTime, uint64_t nwid, uint64_t memberId)
 {
 	std::unique_lock<std::mutex> l(_membersExpiringSoon_l);
 	_membersExpiringSoon.insert(std::pair< int64_t, std::pair< uint64_t, uint64_t > >(expTime, std::pair< uint64_t, uint64_t >(nwid, memberId)));
diff --git a/controller/DBMirrorSet.hpp b/controller/DBMirrorSet.hpp
index ebb39b5d8..83dc228aa 100644
--- a/controller/DBMirrorSet.hpp
+++ b/controller/DBMirrorSet.hpp
@@ -60,8 +60,8 @@ public:
 		_dbs.push_back(db);
 	}
 
-	std::set< std::pair<uint64_t, uint64_t> > membersExpiringSoon();
-	void memberExpiring(int64_t expTime, uint64_t nwid, uint64_t memberId);
+	void membersExpiring(std::set< std::pair<uint64_t, uint64_t> > &soon, std::set< std::pair<uint64_t, uint64_t> > &expired);
+	void memberWillExpire(int64_t expTime, uint64_t nwid, uint64_t memberId);
 
 private:
 	DB::ChangeListener *const _listener;
diff --git a/controller/EmbeddedNetworkController.cpp b/controller/EmbeddedNetworkController.cpp
index 9ff7420cd..e54848ae4 100644
--- a/controller/EmbeddedNetworkController.cpp
+++ b/controller/EmbeddedNetworkController.cpp
@@ -1379,7 +1379,7 @@ void EmbeddedNetworkController::_request(
 			}
 			return;
 		} else if (authorized) {
-			_db.memberExpiring(authenticationExpiryTime, nwid, identity.address().toInt());
+			_db.memberWillExpire(authenticationExpiryTime, nwid, identity.address().toInt());
 		}
 	}
 
@@ -1836,22 +1836,29 @@ void EmbeddedNetworkController::_startThreads()
 					}
 				}
 
-				auto expiringSoon = _db.membersExpiringSoon();
-				for(auto soon=expiringSoon.begin();soon!=expiringSoon.end();++soon) {
+				std::set< std::pair<uint64_t, uint64_t> > soon;
+				std::set< std::pair<uint64_t, uint64_t> > expired;
+				_db.membersExpiring(soon, expired);
+
+				for(auto s=soon.begin();s!=soon.end();++s) {
 					Identity identity;
 					Dictionary<ZT_NETWORKCONFIG_METADATA_DICT_CAPACITY> lastMetaData;
 					{
 						std::unique_lock<std::mutex> ll(_memberStatus_l);
-						auto ms = _memberStatus.find(_MemberStatusKey(soon->first, soon->second));
+						auto ms = _memberStatus.find(_MemberStatusKey(s->first, s->second));
 						if (ms != _memberStatus.end()) {
 							lastMetaData = ms->second.lastRequestMetaData;
 							identity = ms->second.identity;
 						}
 					}
 					if (identity) {
-						request(soon->first,InetAddress(),0,identity,lastMetaData);
+						request(s->first,InetAddress(),0,identity,lastMetaData);
 					}
 				}
+
+				for(auto e=expired.begin();e!=expired.end();++e) {
+					onNetworkMemberDeauthorize(nullptr, e->first, e->second);
+				}
 			}
 		});
 	}