diff --git a/src/Tgstation.Server.Api/Models/DreamDaemon.cs b/src/Tgstation.Server.Api/Models/DreamDaemon.cs
index f78ffd2f15..ac982cf3d0 100644
--- a/src/Tgstation.Server.Api/Models/DreamDaemon.cs
+++ b/src/Tgstation.Server.Api/Models/DreamDaemon.cs
@@ -23,7 +23,7 @@ namespace Tgstation.Server.Api.Models
 		public bool? Running { get; set; }
 
 		/// <summary>
-		/// The current <see cref="DreamDaemonSecurity"/> of <see cref="DreamDaemon"/>
+		/// The current <see cref="DreamDaemonSecurity"/> of <see cref="DreamDaemon"/>. May be downgraded due to requirements of <see cref="ActiveCompileJob"/>
 		/// </summary>
 		public DreamDaemonSecurity? CurrentSecurity { get; set; }
 
diff --git a/src/Tgstation.Server.Host/Components/Watchdog/ISessionControllerFactory.cs b/src/Tgstation.Server.Host/Components/Watchdog/ISessionControllerFactory.cs
index 645af10171..4873ce5b21 100644
--- a/src/Tgstation.Server.Host/Components/Watchdog/ISessionControllerFactory.cs
+++ b/src/Tgstation.Server.Host/Components/Watchdog/ISessionControllerFactory.cs
@@ -13,7 +13,7 @@ namespace Tgstation.Server.Host.Components.Watchdog
 		/// <summary>
 		/// Create a <see cref="ISessionController"/> from a freshly launch DreamDaemon instance
 		/// </summary>
-		/// <param name="launchParameters">The <see cref="DreamDaemonLaunchParameters"/> to use</param>
+		/// <param name="launchParameters">The <see cref="DreamDaemonLaunchParameters"/> to use. <see cref="DreamDaemonLaunchParameters.SecurityLevel"/> will be updated with the minumum required security level for the launch</param>
 		/// <param name="dmbProvider">The <see cref="IDmbProvider"/> to use</param>
 		/// <param name="currentByondLock">The current <see cref="IByondExecutableLock"/> if any</param>
 		/// <param name="primaryPort">If the <see cref="DreamDaemonLaunchParameters.PrimaryPort"/> of <paramref name="launchParameters"/> should be used</param>
diff --git a/src/Tgstation.Server.Host/Components/Watchdog/IWatchdog.cs b/src/Tgstation.Server.Host/Components/Watchdog/IWatchdog.cs
index 6c8b65b05f..2002597284 100644
--- a/src/Tgstation.Server.Host/Components/Watchdog/IWatchdog.cs
+++ b/src/Tgstation.Server.Host/Components/Watchdog/IWatchdog.cs
@@ -56,7 +56,7 @@ namespace Tgstation.Server.Host.Components.Watchdog
 		/// <summary>
 		/// Changes the <see cref="ActiveLaunchParameters"/>. If currently <see cref="Running"/> triggers a graceful restart
 		/// </summary>
-		/// <param name="launchParameters">The new <see cref="DreamDaemonLaunchParameters"/></param>
+		/// <param name="launchParameters">The new <see cref="DreamDaemonLaunchParameters"/>. May be modified</param>
 		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation</param>
 		/// <returns>A <see cref="Task"/> representing the running operation</returns>
 		Task ChangeSettings(DreamDaemonLaunchParameters launchParameters, CancellationToken cancellationToken);
diff --git a/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs b/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs
index b5ec781ba0..dae993db92 100644
--- a/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs
+++ b/src/Tgstation.Server.Host/Components/Watchdog/SessionControllerFactory.cs
@@ -206,7 +206,7 @@ namespace Tgstation.Server.Host.Components.Watchdog
 						try
 						{
 							//return the session controller for it
-							return new SessionController(new ReattachInformation
+							var result = new SessionController(new ReattachInformation
 							{
 								AccessIdentifier = accessIdentifier,
 								Dmb = dmbProvider,
@@ -217,6 +217,11 @@ namespace Tgstation.Server.Host.Components.Watchdog
 								ChatCommandsJson = interopInfo.ChatCommandsJson,
 								ServerCommandsJson = interopInfo.ServerCommandsJson,
 							}, process, byondLock, byondTopicSender, chatJsonTrackingContext, context, chat, loggerFactory.CreateLogger<SessionController>(), launchParameters.SecurityLevel, launchParameters.StartupTimeout);
+
+							//writeback launch parameter's fixed security level
+							launchParameters.SecurityLevel = securityLevelToUse;
+
+							return result;
 						}
 						catch
 						{
diff --git a/src/Tgstation.Server.Host/Components/Watchdog/Watchdog.cs b/src/Tgstation.Server.Host/Components/Watchdog/Watchdog.cs
index 0a852be342..28a1eeb60c 100644
--- a/src/Tgstation.Server.Host/Components/Watchdog/Watchdog.cs
+++ b/src/Tgstation.Server.Host/Components/Watchdog/Watchdog.cs
@@ -150,7 +150,7 @@ namespace Tgstation.Server.Host.Components.Watchdog
 		/// <param name="byondTopicSender">The value of <see cref="byondTopicSender"/></param>
 		/// <param name="eventConsumer">The value of <see cref="eventConsumer"/></param>
 		/// <param name="jobManager">The value of <see cref="jobManager"/></param>
-		/// <param name="initialLaunchParameters">The initial value of <see cref="ActiveLaunchParameters"/></param>
+		/// <param name="initialLaunchParameters">The initial value of <see cref="ActiveLaunchParameters"/>. May be modified</param>
 		/// <param name="instance">The value of <see cref="instance"/></param>
 		/// <param name="autoStart">The value of <see cref="autoStart"/></param>
 		public Watchdog(IChat chat, ISessionControllerFactory sessionControllerFactory, IDmbFactory dmbFactory, IServerControl serverUpdater, ILogger<Watchdog> logger, IReattachInfoHandler reattachInfoHandler, IDatabaseContextFactory databaseContextFactory, IByondTopicSender byondTopicSender, IEventConsumer eventConsumer, IJobManager jobManager, DreamDaemonLaunchParameters initialLaunchParameters, Api.Models.Instance instance, bool autoStart)
diff --git a/src/Tgstation.Server.Host/Controllers/DreamDaemonController.cs b/src/Tgstation.Server.Host/Controllers/DreamDaemonController.cs
index 34d8158a05..85d7841d8c 100644
--- a/src/Tgstation.Server.Host/Controllers/DreamDaemonController.cs
+++ b/src/Tgstation.Server.Host/Controllers/DreamDaemonController.cs
@@ -196,10 +196,11 @@ namespace Tgstation.Server.Host.Controllers
 				return BadRequest(new ErrorMessage { Message = "Primary port and secondary port cannot be the same!" });
 
 			var wd = instanceManager.GetInstance(Instance).Watchdog;
-
-			//run these in parallel because they are equally as important
-			await Task.WhenAll(DatabaseContext.Save(cancellationToken), wd.ChangeSettings(current, cancellationToken)).ConfigureAwait(false);
 			
+			await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
+			//run this second because current may be modified by it
+			await wd.ChangeSettings(current, cancellationToken).ConfigureAwait(false);
+
 			if (!oldSoftRestart.Value && current.SoftRestart.Value)
 				await wd.Restart(true, cancellationToken).ConfigureAwait(false);
 			else if (!oldSoftShutdown.Value && current.SoftShutdown.Value)