diff --git a/apps/api/src/devices/devices.controller.ts b/apps/api/src/devices/devices.controller.ts
index 814307e..36a977f 100644
--- a/apps/api/src/devices/devices.controller.ts
+++ b/apps/api/src/devices/devices.controller.ts
@@ -38,8 +38,7 @@ export class DevicesController {
   @UseGuards(DeviceAuthGuard)
   @ApiOperation({ summary: 'Sync device state with server' })
   async sync(@Param('deviceId') deviceId: string, @Body() dto: SyncDto, @Req() req: any) {
-    const device = req.device;
-    return this.devicesService.sync(device, dto);
+    return this.devicesService.sync(req.user, dto);
   }
 
   @Post(':deviceId/commands/:commandId/ack')
@@ -51,8 +50,7 @@ export class DevicesController {
     @Body() dto: AckCommandDto,
     @Req() req: any,
   ) {
-    const device = req.device;
-    return this.devicesService.ackCommand(device, commandId, dto);
+    return this.devicesService.ackCommand(req.user, commandId, dto);
   }
 
   @Get('generation-code')
diff --git a/apps/api/src/devices/devices.service.ts b/apps/api/src/devices/devices.service.ts
index 46c6748..e774611 100644
--- a/apps/api/src/devices/devices.service.ts
+++ b/apps/api/src/devices/devices.service.ts
@@ -18,6 +18,9 @@ export class DevicesService {
   ) {}
 
   async sync(device: any, dto: SyncDto) {
+    if (!device) {
+      throw new NotFoundException({ code: 'device_not_found', message: 'Device not found' });
+    }
     if (device.revokedAt) {
       throw new ForbiddenException({ code: 'device_revoked', message: 'Device has been revoked' });
     }
@@ -150,6 +153,9 @@ export class DevicesService {
   }
 
   async ackCommand(device: any, commandId: string, dto: AckCommandDto) {
+    if (!device) {
+      throw new NotFoundException({ code: 'device_not_found', message: 'Device not found' });
+    }
     const command = await this.prisma.remoteCommand.findUnique({ where: { id: commandId } });
 
     if (!command) {