diff --git a/service/src/main/java/io/github/a13e300/tricky_store/Config.kt b/service/src/main/java/io/github/a13e300/tricky_store/Config.kt
index 5f57ebc..e85968a 100644
--- a/service/src/main/java/io/github/a13e300/tricky_store/Config.kt
+++ b/service/src/main/java/io/github/a13e300/tricky_store/Config.kt
@@ -34,12 +34,12 @@ object Config {
     private const val KEYBOX_FILE = "keybox.xml"
     private val root = File(CONFIG_PATH)
 
-    object ConfigObserver : FileObserver(root, CLOSE_WRITE or DELETE) {
+    object ConfigObserver : FileObserver(root, CLOSE_WRITE or DELETE or MOVED_FROM or MOVED_TO) {
         override fun onEvent(event: Int, path: String?) {
             path ?: return
             val f = when (event) {
-                CLOSE_WRITE -> File(root, path)
-                DELETE -> null
+                CLOSE_WRITE, MOVED_TO -> File(root, path)
+                DELETE, MOVED_FROM -> null
                 else -> return
             }
             when (path) {
diff --git a/service/src/main/java/io/github/a13e300/tricky_store/KeystoreInterceptor.kt b/service/src/main/java/io/github/a13e300/tricky_store/KeystoreInterceptor.kt
index db82e47..92b3719 100644
--- a/service/src/main/java/io/github/a13e300/tricky_store/KeystoreInterceptor.kt
+++ b/service/src/main/java/io/github/a13e300/tricky_store/KeystoreInterceptor.kt
@@ -33,7 +33,7 @@ object KeystoreInterceptor  : BinderInterceptor() {
         callingPid: Int,
         data: Parcel
     ): Result {
-        if (code == targetTransaction) {
+        if (code == targetTransaction && CertHack.canHack() && Config.targetPackages.isNotEmpty()) {
             Logger.d("intercept pre  $target uid=$callingUid pid=$callingPid dataSz=${data.dataSize()}")
             kotlin.runCatching {
                 val ps = getPm()?.getPackagesForUid(callingUid)
diff --git a/service/src/main/java/io/github/a13e300/tricky_store/keystore/CertHack.java b/service/src/main/java/io/github/a13e300/tricky_store/keystore/CertHack.java
index b395b40..930003c 100644
--- a/service/src/main/java/io/github/a13e300/tricky_store/keystore/CertHack.java
+++ b/service/src/main/java/io/github/a13e300/tricky_store/keystore/CertHack.java
@@ -55,6 +55,10 @@ public final class CertHack {
         }
     }
 
+    public static boolean canHack() {
+        return !keyboxes.isEmpty();
+    }
+
     public static void readFromXml(String data) {
         keyboxes.clear();
         if (data == null) {
@@ -91,7 +95,7 @@ public final class CertHack {
             }
             Logger.i("update " + numberOfKeyboxes + " keyboxes");
         } catch (Throwable t) {
-            Logger.e("Error loading xml file: " + t);
+            Logger.e("Error loading xml file (keyboxes cleared): " + t);
         }
     }