diff --git a/lib/connections/service.go b/lib/connections/service.go
index 0f656374..6d6426d3 100644
--- a/lib/connections/service.go
+++ b/lib/connections/service.go
@@ -245,7 +245,9 @@ next:
 
 		deviceCfg, ok := s.cfg.Device(remoteID)
 		if !ok {
-			panic("bug: unknown device should already have been rejected")
+			l.Infof("Device %s removed from config during connection attempt at %s", remoteID, c)
+			c.Close()
+			continue
 		}
 
 		// Verify the name on the certificate. By default we set it to