diff --git a/src/app/hack/[slug]/actions.ts b/src/app/hack/[slug]/actions.ts
index 4321c0d..59e6c76 100644
--- a/src/app/hack/[slug]/actions.ts
+++ b/src/app/hack/[slug]/actions.ts
@@ -71,7 +71,11 @@ export async function getSignedPatchUrl(slug: string): Promise<{ ok: true; url:
   }
 }
 
-export async function updatePatchDownloadCount(patchId: number, deviceId: string): Promise<{ ok: true; didIncrease: boolean } | { ok: false; error: string }> {
+export async function updatePatchDownloadCount(patchId: number, deviceIdObscured: string[]): Promise<{ ok: true; didIncrease: boolean } | { ok: false; error: string }> {
+  if (deviceIdObscured.length !== 5) {
+    return { ok: false, error: "Invalid device ID" };
+  }
+  const deviceId = deviceIdObscured.join("-");
   const supabase = await createClient();
   const { error: updateError } = await supabase
     .from("patch_downloads")
diff --git a/src/components/Hack/HackActions.tsx b/src/components/Hack/HackActions.tsx
index 7a6f5ef..cb30126 100644
--- a/src/components/Hack/HackActions.tsx
+++ b/src/components/Hack/HackActions.tsx
@@ -221,7 +221,8 @@ const HackActions: React.FC<HackActionsProps> = ({
             deviceId = crypto.randomUUID();
             localStorage.setItem(key, deviceId);
           }
-          const result = await updatePatchDownloadCount(patchId, deviceId);
+          const deviceIdObscured = deviceId.split("-");
+          const result = await updatePatchDownloadCount(patchId, deviceIdObscured);
           if (!result.ok) {
             console.error(result.error);
           } else if (result.didIncrease) {