diff --git a/kotlin/android/app/src/main/java/dev/firezone/android/tunnel/TunnelService.kt b/kotlin/android/app/src/main/java/dev/firezone/android/tunnel/TunnelService.kt
index 29d34d7be..3db3e1db2 100644
--- a/kotlin/android/app/src/main/java/dev/firezone/android/tunnel/TunnelService.kt
+++ b/kotlin/android/app/src/main/java/dev/firezone/android/tunnel/TunnelService.kt
@@ -199,6 +199,12 @@ class TunnelService : VpnService() {
         super.onDestroy()
     }
 
+    override fun onRevoke() {
+        Log.d(TAG, "onRevoke")
+        disconnect()
+        super.onRevoke()
+    }
+
     // Call this to stop the tunnel and shutdown the service, leaving the token intact.
     fun disconnect() {
         Log.d(TAG, "disconnect")