diff --git a/lib/ms-tunnel.js b/lib/ms-tunnel.js
index e04dea4..d32f26d 100644
--- a/lib/ms-tunnel.js
+++ b/lib/ms-tunnel.js
@@ -1,3 +1,4 @@
+const bs58 = require('bs58')
 const debug = require('debug')('ppppp:hub-client')
 const pull = require('pull-stream')
 const run = require('promisify-tuple')
@@ -31,7 +32,9 @@ const makeTunnelPlugin = (hubs, sstack) => (/** @type {any}} */ msConfig) => {
         pull.filter(({ type }) => type === 'connected'),
         pull.drain(async ({ address, key, details }) => {
           if (!key) return
-          if (hubs.has(key)) return
+          // TODO: once secret-stack is updated, we won't need this anymore:
+          const pubkey = bs58.encode(Buffer.from(key, 'base64'))
+          if (hubs.has(pubkey)) return
           if (!details?.rpc) return
           if (address.startsWith('tunnel:')) return
           const rpc = details.rpc
@@ -41,13 +44,13 @@ const makeTunnelPlugin = (hubs, sstack) => (/** @type {any}} */ msConfig) => {
             debug('failure when calling hub.metadata: %s', err.message ?? err)
             return
           }
-          debug('connected to hub %s', key)
-          if (hubs.has(key)) {
-            hubs.get(key)?.cancel()
-            hubs.delete(key)
+          debug('connected to hub %s', pubkey)
+          if (hubs.has(pubkey)) {
+            hubs.get(pubkey)?.cancel()
+            hubs.delete(pubkey)
           }
-          const obs = new HubObserver(sstack, key, address, res, rpc, onConnect)
-          hubs.set(key, obs)
+          const obs = new HubObserver(sstack, pubkey, address, res, rpc, onConnect)
+          hubs.set(pubkey, obs)
         })
       )
 
@@ -57,9 +60,11 @@ const makeTunnelPlugin = (hubs, sstack) => (/** @type {any}} */ msConfig) => {
         pull.filter(({ type }) => type === 'disconnected'),
         pull.drain(({ key }) => {
           if (!key) return
-          if (!hubs.has(key)) return
-          hubs.get(key)?.close()
-          hubs.delete(key)
+          // TODO: once secret-stack is updated, we won't need this anymore:
+          const pubkey = bs58.encode(Buffer.from(key, 'base64'))
+          if (!hubs.has(pubkey)) return
+          hubs.get(pubkey)?.close()
+          hubs.delete(pubkey)
         })
       )
 
diff --git a/package.json b/package.json
index da70a04..863d9e5 100644
--- a/package.json
+++ b/package.json
@@ -23,6 +23,7 @@
     "node": ">=16"
   },
   "dependencies": {
+    "bs58": "^5.0.0",
     "debug": "^4.3.4",
     "promisify-tuple": "~1.2.0",
     "pull-notify": "~0.1.2",
@@ -32,8 +33,8 @@
   },
   "devDependencies": {
     "@types/debug": "^4.1.8",
+    "@types/node": "16.x",
     "@types/pull-stream": "^3.6.2",
-    "bs58": "^5.0.0",
     "c8": "7",
     "husky": "^4.3.0",
     "prettier": "^2.6.2",