diff --git a/piawg.sh b/piawg.sh
index 3ee1292..c47d282 100755
--- a/piawg.sh
+++ b/piawg.sh
@@ -7,8 +7,12 @@
 
 msg() { printf '[%s]: %s\n' "${2-INFO}" "$1"; }
 info() { [ "$PIAWG_VERBOSE" -eq 1 ] && msg "$1"; }
+debug() { [ "$PIAWG_DEBUG" -eq 1 ] && msg "$1" 'DEBUG'; }
 warn() { msg "$1" 'WARN'; }
-err() { msg "$1" 'ERROR'; exit 1; }
+err() {
+	msg "$1" 'ERROR'
+	exit 1
+}
 
 check_http() { [ "$1" = "${2:-200}" ] && return 0 || return 1; }
 check_token() { printf '%s\n' "$1" | grep -q '^[0-9A-Fa-f]\{128\}$'; }
@@ -24,10 +28,13 @@ bao_curl() {
 	local error
 	local http_code
 	local notfound
+	local content_type
 	notfound=0
-	while getopts "n" opt; do
+	content_type='application/json'
+	while getopts "np" opt; do
 		case "$opt" in
 		n) notfound=1 ;;
+		p) content_type='application/merge-patch+json' ;;
 		*) err "bao_curl option '$opt' not found" ;;
 		esac
 	done
@@ -35,7 +42,7 @@ bao_curl() {
 	path="$BAO_ADDR/v1/$1"
 	shift
 	error="Failed request to '$path'"
-	if ! response=$(_curl -H 'Content-Type: application/json' \
+	if ! response=$(_curl -H "Content-Type: $content_type" \
 		-H "X-Vault-Token: $bao_token" -w '\n%{http_code}' "$@" "$path"); then
 		err "$error"
 	fi
@@ -72,6 +79,7 @@ pia_addkey() {
 	local port
 	local peer_ip
 	local updates
+	local server_vip
 	# Add pubkey via PIA API and get connection details
 	info "Adding '$piawg_pubkey' to PIA server $server_cn"
 	if ! response=$(
@@ -85,6 +93,7 @@ pia_addkey() {
 	fi
 	[ "$(printf '%s' "$response" | jq -r '.status')" != "OK" ] &&
 		err "Failed to addKey to $server_cn"
+	debug "PIA addKey reply\n$(echo "$response" | jq .)"
 
 	# Update Wireguard config on OPNsense
 	updates='{}'
@@ -105,6 +114,7 @@ pia_addkey() {
 		updates="$(printf '%s' "$updates" |
 			jq --arg s "$piawg_uuid" '.servers = $s')"
 		info "Updating connection details of $OPN_IF peer $OPN_PEER"
+		debug "$OPN_PEER updates\n$(echo "$updates" | jq .)"
 		if [ "$(opn_curl "wireguard/client/setClient/$piawgsrv_uuid" \
 			-d "$(printf '%s' "$updates" | jq '{client: .}')" |
 			jq -r '.result')" != "saved" ]; then
@@ -127,6 +137,11 @@ pia_addkey() {
 		err "Failed to reload Wireguard service"
 	fi
 
+	server_vip="$(printf '%s' "$response" | jq -r '.server_vip')"
+	info "Updating OpenBao KV server_vip at $BAO_PATH_CONFIG to $server_vip"
+	bao_curl -p "$BAO_KV_MOUNT/data/$BAO_PATH_CONFIG" -X PATCH \
+		-d "$(jq -n --arg ip "$server_vip" '{data:{server_vip:$ip}}')"
+
 	# Update firewall rule alias
 	piawg_ip_alias="$(opn_curl 'firewall/alias/searchItem' -d '{}' |
 		jq -r ".rows[] | select(.name == \"$OPN_ALIAS\") | .uuid")"
@@ -188,9 +203,11 @@ renew_token() {
 	unset pia_token
 }
 
+PIAWG_DEBUG=0
 PIAWG_VERBOSE=0
-while getopts "v" opt; do
+while getopts "dv" opt; do
 	case $opt in
+	d) PIAWG_VERBOSE=1; PIAWG_DEBUG=1 ;;
 	v) PIAWG_VERBOSE=1 ;;
 	*)
 		printf '%s\n' "Usage: $0 [-v]" >&2
@@ -297,6 +314,7 @@ opn_if_reply="$(opn_curl 'wireguard/server/searchServer' -d '{}' |
 piawg_uuid="$(printf '%s' "$opn_if_reply" | jq -r .uuid)"
 piawg_pubkey="$(printf '%s' "$opn_if_reply" | jq -r .pubkey)"
 piawg_tunaddr="$(printf '%s' "$opn_if_reply" | jq -r .tunneladdress)"
+debug "Wireguard instance $OPN_IF\n$(echo "$opn_if_reply" | jq .)"
 unset opn_if_reply
 
 opn_peer_reply="$(opn_curl 'wireguard/client/searchClient' -d '{}' |