diff --git a/tfclient/src/apiworker.rs b/tfclient/src/apiworker.rs
index 3d02828..6f328db 100644
--- a/tfclient/src/apiworker.rs
+++ b/tfclient/src/apiworker.rs
@@ -12,6 +12,7 @@ use trifid_pki::x25519_dalek::StaticSecret;
 use crate::config::{load_cdata, save_cdata, TFClientConfig};
 use crate::daemon::ThreadMessageSender;
 use crate::dirs::get_nebulaconfig_file;
+use crate::nebulaworker::NebulaWorkerMessage;
 
 pub enum APIWorkerMessage {
     Shutdown,
@@ -19,7 +20,7 @@ pub enum APIWorkerMessage {
     Timer
 }
 
-pub fn apiworker_main(config: TFClientConfig, instance: String, url: String, _transmitters: ThreadMessageSender, rx: Receiver<APIWorkerMessage>) {
+pub fn apiworker_main(config: TFClientConfig, instance: String, url: String, tx: ThreadMessageSender, rx: Receiver<APIWorkerMessage>) {
     let server = Url::parse(&url).unwrap();
 
     let client = Client::new(format!("tfclient/{}", env!("CARGO_PKG_VERSION")), server).unwrap();
@@ -44,9 +45,106 @@ pub fn apiworker_main(config: TFClientConfig, instance: String, url: String, _tr
                         };
                         if cdata.creds.is_none() {
                             info!("not enrolled, cannot perform config update");
+                            match save_cdata(&instance, cdata) {
+                                Ok(_) => (),
+                                Err(e) => {
+                                    error!("Error saving cdata: {}", e);
+                                    error!("APIWorker exiting with error");
+                                    return;
+                                }
+                            }
+                            continue;
+                        }
+                        let creds = cdata.clone().creds.unwrap_or_else(|| unreachable!());
+
+                        info!("checking for update");
+                        let update_available = match client.check_for_update(&creds) {
+                            Ok(ua) => ua,
+                            Err(e) => {
+                                error!("error checking for config update: {}", e);
+                                match save_cdata(&instance, cdata) {
+                                    Ok(_) => (),
+                                    Err(e) => {
+                                        error!("Error saving cdata: {}", e);
+                                        error!("APIWorker exiting with error");
+                                        return;
+                                    }
+                                }
+                                continue;
+                            }
+                        };
+
+                        if !update_available {
+                            match save_cdata(&instance, cdata) {
+                                Ok(_) => (),
+                                Err(e) => {
+                                    error!("Error saving cdata: {}", e);
+                                    error!("APIWorker exiting with error");
+                                    return;
+                                }
+                            }
+                            info!("no config update available");
                             continue;
                         }
 
+                        info!("updated configuration is avaliable");
+                        info!("updating configuration");
+
+                        let (config, dh_privkey, creds) = match client.do_update(&creds) {
+                            Ok(d) => d,
+                            Err(e) => {
+                                error!("error requesting updating config: {}", e);
+                                match save_cdata(&instance, cdata) {
+                                    Ok(_) => (),
+                                    Err(e) => {
+                                        error!("Error saving cdata: {}", e);
+                                        error!("APIWorker exiting with error");
+                                        return;
+                                    }
+                                }
+                                continue;
+                            }
+                        };
+
+                        cdata.creds = Some(creds);
+                        cdata.dh_privkey = Some(dh_privkey.try_into().expect("32 != 32"));
+
+                        match fs::write(get_nebulaconfig_file(&instance).expect("Unable to determine nebula config file location"), config) {
+                            Ok(_) => (),
+                            Err(e) => {
+                                error!("unable to save nebula config: {}", e);
+                                match save_cdata(&instance, cdata) {
+                                    Ok(_) => (),
+                                    Err(e) => {
+                                        error!("Error saving cdata: {}", e);
+                                        error!("APIWorker exiting with error");
+                                        return;
+                                    }
+                                }
+                                continue;
+                            }
+                        }
+
+                        match save_cdata(&instance, cdata) {
+                            Ok(_) => (),
+                            Err(e) => {
+                                error!("Error saving cdata: {}", e);
+                                error!("APIWorker exiting with error");
+                                return;
+                            }
+                        }
+
+                        info!("configuration updated successfully!");
+                        info!("sending signal to nebula thread to reload config");
+
+                        match tx.nebula_thread.send(NebulaWorkerMessage::ConfigUpdated) {
+                            Ok(_) => (),
+                            Err(e) => {
+                                error!("unable to tell nebula thread to update config: {}", e);
+                                error!("APIWorker exiting with error");
+                                return;
+                            }
+                        }
                     },
                     APIWorkerMessage::Enroll { code } => {
                         info!("recv on command socket: enroll {}", code);
@@ -94,6 +192,15 @@ pub fn apiworker_main(config: TFClientConfig, instance: String, url: String, _tr
                         }
 
                         info!("Configuration updated. Sending signal to Nebula worker thread");
+
+                        match tx.nebula_thread.send(NebulaWorkerMessage::ConfigUpdated) {
+                            Ok(_) => (),
+                            Err(e) => {
+                                error!("unable to tell nebula thread to update config: {}", e);
+                                error!("APIWorker exiting with error");
+                                return;
+                            }
+                        }
                     }
                 }
             },