diff --git a/pom.xml b/pom.xml
index 25a1b738..03678cc8 100644
--- a/pom.xml
+++ b/pom.xml
@@ -15,7 +15,7 @@
         <metrics.version>3.1.2</metrics.version>
         <librato.reporter.version>2.2.0.5</librato.reporter.version>
         <dagger.version>1.2.2</dagger.version>
-        <gaibu.version>0.1.96</gaibu.version>
+        <gaibu.version>0.1.99</gaibu.version>
     </properties>
 
     <distributionManagement>
diff --git a/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessor.java b/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessor.java
index 6b596ee0..31111980 100644
--- a/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessor.java
+++ b/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessor.java
@@ -1,5 +1,9 @@
 package com.hello.suripu.workers.expansions;
 
+import com.google.common.base.Optional;
+import com.google.common.collect.Sets;
+import com.google.protobuf.InvalidProtocolBufferException;
+
 import com.amazonaws.services.kinesis.clientlibrary.exceptions.InvalidStateException;
 import com.amazonaws.services.kinesis.clientlibrary.exceptions.ShutdownException;
 import com.amazonaws.services.kinesis.clientlibrary.interfaces.IRecordProcessorCheckpointer;
@@ -8,16 +12,22 @@
 import com.codahale.metrics.Meter;
 import com.codahale.metrics.MetricRegistry;
 import com.fasterxml.jackson.databind.ObjectMapper;
-import com.google.common.base.Optional;
-import com.google.common.collect.Sets;
-import com.google.protobuf.InvalidProtocolBufferException;
 import com.hello.suripu.api.expansions.ExpansionProtos;
 import com.hello.suripu.core.db.MergedUserInfoDynamoDB;
 import com.hello.suripu.core.db.ScheduledRingTimeHistoryDAODynamoDB;
 import com.hello.suripu.core.models.AlarmExpansion;
 import com.hello.suripu.core.models.ValueRange;
-import com.hello.suripu.core.speech.interfaces.Vault;
 import com.hello.suripu.workers.framework.HelloBaseRecordProcessor;
+
+import org.joda.time.DateTime;
+import org.joda.time.DateTimeZone;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 import is.hello.gaibu.core.models.Expansion;
 import is.hello.gaibu.core.models.ExpansionData;
 import is.hello.gaibu.core.models.ExpansionDeviceData;
@@ -25,21 +35,12 @@
 import is.hello.gaibu.core.stores.ExpansionStore;
 import is.hello.gaibu.core.stores.ExternalOAuthTokenStore;
 import is.hello.gaibu.core.stores.PersistentExpansionDataStore;
-import is.hello.gaibu.core.utils.TokenUtils;
 import is.hello.gaibu.homeauto.factories.HomeAutomationExpansionDataFactory;
 import is.hello.gaibu.homeauto.factories.HomeAutomationExpansionFactory;
 import is.hello.gaibu.homeauto.interfaces.HomeAutomationExpansion;
 import is.hello.gaibu.homeauto.models.AlarmActionStatus;
-import org.joda.time.DateTime;
-import org.joda.time.DateTimeZone;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import redis.clients.jedis.JedisPool;
 
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 import static com.codahale.metrics.MetricRegistry.name;
 
 public class AlarmActionRecordProcessor extends HelloBaseRecordProcessor {
@@ -51,7 +52,6 @@ public class AlarmActionRecordProcessor extends HelloBaseRecordProcessor {
     private final ExpansionStore<Expansion> expansionStore;
     private final ExternalOAuthTokenStore<ExternalToken> externalTokenStore;
     private final PersistentExpansionDataStore expansionDataStore;
-    private final Vault tokenKMSVault;
     private final AlarmActionCheckPointerRedis checkPointer;
     private final Alerter alerter;
 
@@ -71,7 +71,6 @@ public AlarmActionRecordProcessor(final MergedUserInfoDynamoDB mergedUserInfoDyn
                                       final ExpansionStore<Expansion> expansionStore,
                                       final ExternalOAuthTokenStore<ExternalToken> externalTokenStore,
                                       final PersistentExpansionDataStore expansionDataStore,
-                                      final Vault tokenKMSVault,
                                       final JedisPool jedisPool,
                                       final Alerter alerter){
 
@@ -82,7 +81,6 @@ public AlarmActionRecordProcessor(final MergedUserInfoDynamoDB mergedUserInfoDyn
         this.expansionStore = expansionStore;
         this.externalTokenStore = externalTokenStore;
         this.expansionDataStore = expansionDataStore;
-        this.tokenKMSVault = tokenKMSVault;
         this.alerter = alerter;
 
         this.actionsExecuted = metrics.meter(name(AlarmActionRecordProcessor.class, "actions-executed"));
@@ -250,7 +248,7 @@ public Boolean attemptAlarmAction(final String deviceId, final Long expansionId,
 
         final ExpansionDeviceData appData = expansionDeviceDataOptional.get();
 
-        final Optional<String> decryptedTokenOptional = TokenUtils.getDecryptedExternalToken(externalTokenStore, tokenKMSVault, deviceId, expansion, false);
+        final Optional<String> decryptedTokenOptional = externalTokenStore.getDecryptedExternalToken(deviceId, expansion, false);
 
         if(!decryptedTokenOptional.isPresent()) {
             LOGGER.error("error=missing-decrypted-token sense_id={} expansion_id={}", deviceId, expansion.id);
diff --git a/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessorFactory.java b/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessorFactory.java
index 3bd00d3a..b50fd0b4 100644
--- a/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessorFactory.java
+++ b/src/main/java/com/hello/suripu/workers/expansions/AlarmActionRecordProcessorFactory.java
@@ -8,7 +8,6 @@
 import com.hello.suripu.core.db.MergedUserInfoDynamoDB;
 import com.hello.suripu.core.db.ScheduledRingTimeHistoryDAODynamoDB;
 import com.hello.suripu.core.db.TimeZoneHistoryDAO;
-import com.hello.suripu.core.speech.interfaces.Vault;
 
 import is.hello.gaibu.core.models.Expansion;
 import is.hello.gaibu.core.models.ExternalToken;
@@ -29,7 +28,6 @@ public class AlarmActionRecordProcessorFactory implements IRecordProcessorFactor
     private final ExpansionStore<Expansion> expansionStore;
     private final ExternalOAuthTokenStore<ExternalToken> externalTokenStore;
     private final PersistentExpansionDataStore expansionDataStore;
-    private final Vault tokenKMSVault;
     private final JedisPool jedisPool;
     private final Alerter alerter;
 
@@ -41,7 +39,6 @@ public AlarmActionRecordProcessorFactory(
             final ExpansionStore<Expansion> expansionStore,
             final ExternalOAuthTokenStore<ExternalToken> externalTokenStore,
             final PersistentExpansionDataStore expansionDataStore,
-            final Vault tokenKMSVault,
             final JedisPool jedisPool,
             final DeviceDAO deviceDAO,
             final AlertsDAO alertsDAO,
@@ -54,7 +51,6 @@ public AlarmActionRecordProcessorFactory(
         this.expansionStore = expansionStore;
         this.externalTokenStore = externalTokenStore;
         this.expansionDataStore = expansionDataStore;
-        this.tokenKMSVault = tokenKMSVault;
         this.jedisPool = jedisPool;
         this.alerter = new AlarmActionAlerter(deviceDAO, alertsDAO, timeZoneHistoryDAO);
     }
@@ -69,7 +65,6 @@ public IRecordProcessor createProcessor() {
                 this.expansionStore,
                 this.externalTokenStore,
                 this.expansionDataStore,
-                this.tokenKMSVault,
                 this.jedisPool,
                 this.alerter
             );
diff --git a/src/main/java/com/hello/suripu/workers/expansions/AlarmActionWorkerCommand.java b/src/main/java/com/hello/suripu/workers/expansions/AlarmActionWorkerCommand.java
index 1b03a872..d48b4e6d 100644
--- a/src/main/java/com/hello/suripu/workers/expansions/AlarmActionWorkerCommand.java
+++ b/src/main/java/com/hello/suripu/workers/expansions/AlarmActionWorkerCommand.java
@@ -1,5 +1,8 @@
 package com.hello.suripu.workers.expansions;
 
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+
 import com.amazonaws.ClientConfiguration;
 import com.amazonaws.auth.AWSCredentialsProvider;
 import com.amazonaws.auth.DefaultAWSCredentialsProviderChain;
@@ -12,8 +15,6 @@
 import com.amazonaws.services.kms.AWSKMSClient;
 import com.codahale.metrics.graphite.Graphite;
 import com.codahale.metrics.graphite.GraphiteReporter;
-import com.google.common.collect.ImmutableList;
-import com.google.common.collect.ImmutableMap;
 import com.hello.suripu.core.ObjectGraphRoot;
 import com.hello.suripu.core.alerts.AlertsDAO;
 import com.hello.suripu.core.configuration.DynamoDBTableName;
@@ -33,25 +34,29 @@
 import com.hello.suripu.coredropwizard.metrics.RegexMetricFilter;
 import com.hello.suripu.workers.framework.WorkerEnvironmentCommand;
 import com.hello.suripu.workers.framework.WorkerRolloutModule;
-import io.dropwizard.jdbi.DBIFactory;
-import io.dropwizard.setup.Environment;
-import is.hello.gaibu.core.db.ExpansionDataDAO;
-import is.hello.gaibu.core.db.ExpansionsDAO;
-import is.hello.gaibu.core.db.ExternalTokenDAO;
-import is.hello.gaibu.core.stores.PersistentExpansionDataStore;
-import is.hello.gaibu.core.stores.PersistentExpansionStore;
-import is.hello.gaibu.core.stores.PersistentExternalTokenStore;
+
 import net.sourceforge.argparse4j.inf.Namespace;
+
 import org.skife.jdbi.v2.DBI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import redis.clients.jedis.JedisPool;
 
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.util.UUID;
 import java.util.concurrent.TimeUnit;
 
+import io.dropwizard.jdbi.DBIFactory;
+import io.dropwizard.setup.Environment;
+import is.hello.gaibu.core.db.ExpansionDataDAO;
+import is.hello.gaibu.core.db.ExpansionsDAO;
+import is.hello.gaibu.core.db.ExternalTokenDAO;
+import is.hello.gaibu.core.stores.PersistentExpansionDataStore;
+import is.hello.gaibu.core.stores.PersistentExpansionStore;
+import is.hello.gaibu.core.stores.PersistentExternalTokenStore;
+import okhttp3.OkHttpClient;
+import redis.clients.jedis.JedisPool;
+
 public class AlarmActionWorkerCommand extends WorkerEnvironmentCommand<AlarmActionWorkerConfiguration> {
     private final static Logger LOGGER = LoggerFactory.getLogger(AlarmActionWorkerCommand.class);
 
@@ -150,8 +155,11 @@ public void run(Environment environment, Namespace namespace, final AlarmActionW
         final ExpansionsDAO externalApplicationsDAO = commonDB.onDemand(ExpansionsDAO.class);
         final PersistentExpansionStore expansionStore = new PersistentExpansionStore(externalApplicationsDAO);
 
+        // Required for Nest token revocation
+        final OkHttpClient httpClient = new OkHttpClient(); //TODO: configure timeouts
+
         final ExternalTokenDAO externalTokenDAO = commonDB.onDemand(ExternalTokenDAO.class);
-        final PersistentExternalTokenStore externalTokenStore = new PersistentExternalTokenStore(externalTokenDAO, expansionStore);
+        final PersistentExternalTokenStore externalTokenStore = new PersistentExternalTokenStore(externalTokenDAO, expansionStore, tokenKMSVault, httpClient);
 
         final ExpansionDataDAO expansionDataDAO = commonDB.onDemand(ExpansionDataDAO.class);
         final PersistentExpansionDataStore externalAppDataStore = new PersistentExpansionDataStore(expansionDataDAO);
@@ -172,7 +180,6 @@ public void run(Environment environment, Namespace namespace, final AlarmActionW
                 expansionStore,
                 externalTokenStore,
                 externalAppDataStore,
-                tokenKMSVault,
                 jedisPool,
                 deviceDAO,
                 alertsDAO,