diff --git a/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/MullvadVpnService.kt b/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/MullvadVpnService.kt
index 1452ed34f224..e8f8608b794e 100644
--- a/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/MullvadVpnService.kt
+++ b/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/MullvadVpnService.kt
@@ -58,6 +58,7 @@ class MullvadVpnService : TalpidVpnService(), ShouldBeOnForegroundProvider {
 
     override fun onCreate() {
         super.onCreate()
+        Log.d(TAG, "MullvadVpnService: onCreate")
 
         loadKoinModules(listOf(vpnServiceModule, apiEndpointModule))
         with(getKoin()) {
@@ -96,20 +97,24 @@ class MullvadVpnService : TalpidVpnService(), ShouldBeOnForegroundProvider {
     }
 
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        Log.d(TAG, "onStartCommand (intent=$intent, flags=$flags, startId=$startId)")
-        Log.d(TAG, "intent action=${intent?.action}")
+        Log.d(
+            TAG,
+            "onStartCommand (intent=$intent, action=${intent?.action}, flags=$flags, startId=$startId)"
+        )
 
         val startResult = super.onStartCommand(intent, flags, startId)
 
         // Always promote to foreground if connect/disconnect actions are provided to mitigate cases
         // where the service would potentially otherwise be too slow running `startForeground`.
-        Log.d(TAG, "Intent Action: ${intent?.action}")
         when {
             keyguardManager.isKeyguardLocked -> {
                 Log.d(TAG, "Keyguard is locked, ignoring command")
             }
             intent.isFromSystem() || intent?.action == KEY_CONNECT_ACTION -> {
-                _shouldBeOnForeground.update { true }
+                // Only show on foreground if we have permission
+                if (prepare(this) == null) {
+                    _shouldBeOnForeground.update { true }
+                }
                 lifecycleScope.launch { connectionProxy.connectWithoutPermissionCheck() }
             }
             intent?.action == KEY_DISCONNECT_ACTION -> {
@@ -177,6 +182,7 @@ class MullvadVpnService : TalpidVpnService(), ShouldBeOnForegroundProvider {
     }
 
     override fun onDestroy() {
+        Log.d(TAG, "MullvadVpnService: onDestroy")
         managementService.stop()
 
         // Shutting down the daemon gracefully
diff --git a/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/notifications/ForegroundNotificationManager.kt b/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/notifications/ForegroundNotificationManager.kt
index 5cafb3766a18..d65cb7255c08 100644
--- a/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/notifications/ForegroundNotificationManager.kt
+++ b/android/service/src/main/kotlin/net/mullvad/mullvadvpn/service/notifications/ForegroundNotificationManager.kt
@@ -25,8 +25,10 @@ class ForegroundNotificationManager(
         scope.launch {
             foregroundProvider.shouldBeOnForeground.collect {
                 if (it) {
+                    Log.d(TAG, "Starting foreground")
                     notifyForeground(getTunnelStateNotificationOrDefault())
                 } else {
+                    Log.d(TAG, "Stopping foreground")
                     vpnService.stopForeground(Service.STOP_FOREGROUND_DETACH)
                 }
             }
@@ -46,19 +48,20 @@ class ForegroundNotificationManager(
     private fun notifyForeground(tunnelStateNotification: Notification.Tunnel) {
 
         val androidNotification = tunnelStateNotification.toNotification(vpnService)
+        if (VpnService.prepare(vpnService) != null) {
+            // Got connect/disconnect intent, but we  don't have permission to go in foreground.
+            // tunnel state will return permission and we will eventually get stopped by system.
+            Log.d(TAG, "Did not start foreground: VPN permission not granted")
+            return
+        }
+
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            if (VpnService.prepare(vpnService) == null) {
-                vpnService.startForeground(
-                    tunnelStateNotificationProvider.notificationId.value,
-                    androidNotification,
-                    ServiceInfo.FOREGROUND_SERVICE_TYPE_SYSTEM_EXEMPTED
-                )
-            } else {
-                // Got connect/disconnect intent, but we  don't have permission to go in foreground.
-                // tunnel state will return permission and we will eventually get stopped by system.
-                Log.d(TAG, "ForegroundNotification: VPN permission not granted")
-                return
-            }
+            Log.d(TAG, "Starting foreground UPSIDE_DOWN_CAKE")
+            vpnService.startForeground(
+                tunnelStateNotificationProvider.notificationId.value,
+                androidNotification,
+                ServiceInfo.FOREGROUND_SERVICE_TYPE_SYSTEM_EXEMPTED
+            )
         } else {
             vpnService.startForeground(
                 tunnelStateNotificationProvider.notificationId.value,