diff --git a/packages/agent/src/commands/invite.ts b/packages/agent/src/commands/invite.ts
index 30b2381..a0c4fdc 100644
--- a/packages/agent/src/commands/invite.ts
+++ b/packages/agent/src/commands/invite.ts
@@ -1,6 +1,7 @@
 import { Command, Args, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { runControllerHandshake } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
 
 export default class Invite extends Command {
@@ -65,7 +66,7 @@ export default class Invite extends Command {
     this.log('');
 
     await allowList.addDevice({
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),
diff --git a/packages/agent/src/commands/listen.ts b/packages/agent/src/commands/listen.ts
index 875dd34..13f057d 100644
--- a/packages/agent/src/commands/listen.ts
+++ b/packages/agent/src/commands/listen.ts
@@ -1,6 +1,7 @@
 import { Command, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { generateOTC, runTargetHandshake, verifySAS } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 import { createInterface } from 'node:readline';
 
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
@@ -72,7 +73,7 @@ export default class Listen extends Command {
     }
 
     const newDevice = {
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),
diff --git a/packages/cli/src/commands/invite.ts b/packages/cli/src/commands/invite.ts
index 30b2381..a0c4fdc 100644
--- a/packages/cli/src/commands/invite.ts
+++ b/packages/cli/src/commands/invite.ts
@@ -1,6 +1,7 @@
 import { Command, Args, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { runControllerHandshake } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
 
 export default class Invite extends Command {
@@ -65,7 +66,7 @@ export default class Invite extends Command {
     this.log('');
 
     await allowList.addDevice({
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),
diff --git a/packages/cli/src/commands/listen.ts b/packages/cli/src/commands/listen.ts
index 875dd34..13f057d 100644
--- a/packages/cli/src/commands/listen.ts
+++ b/packages/cli/src/commands/listen.ts
@@ -1,6 +1,7 @@
 import { Command, Flags } from '@oclif/core';
 import { loadContext } from '../context.js';
 import { generateOTC, runTargetHandshake, verifySAS } from '../handshake.js';
+import { generateDeviceId } from '../identity.js';
 import { createInterface } from 'node:readline';
 
 const DEFAULT_RELAY = 'wss://relay.authmesh.dev/ws';
@@ -72,7 +73,7 @@ export default class Listen extends Command {
     }
 
     const newDevice = {
-      deviceId: `am_${Buffer.from(result.peerPublicKey).toString('base64url').slice(0, 16)}`,
+      deviceId: generateDeviceId(result.peerPublicKey),
       publicKey: Buffer.from(result.peerPublicKey).toString('base64'),
       friendlyName: result.peerFriendlyName,
       addedAt: new Date().toISOString(),