diff --git a/checkin/endpoint.go b/checkin/endpoint.go
index 6608e7aa..e579506a 100644
--- a/checkin/endpoint.go
+++ b/checkin/endpoint.go
@@ -1,11 +1,11 @@
 package checkin
 
 import (
+	"context"
 	"errors"
 
 	"github.com/go-kit/kit/endpoint"
 	"github.com/micromdm/mdm"
-	"golang.org/x/net/context"
 )
 
 // errInvalidMessageType is an invalid checking command.
diff --git a/checkin/transport_http.go b/checkin/transport_http.go
index a852c412..b5f1777a 100644
--- a/checkin/transport_http.go
+++ b/checkin/transport_http.go
@@ -1,12 +1,12 @@
 package checkin
 
 import (
+	"context"
 	"io"
 	"net/http"
 
 	httptransport "github.com/go-kit/kit/transport/http"
 	"github.com/groob/plist"
-	"golang.org/x/net/context"
 )
 
 type HTTPHandlers struct {
@@ -17,7 +17,6 @@ type HTTPHandlers struct {
 func MakeHTTPHandlers(ctx context.Context, endpoints Endpoints, opts ...httptransport.ServerOption) HTTPHandlers {
 	h := HTTPHandlers{
 		CheckinHandler: httptransport.NewServer(
-			ctx,
 			endpoints.CheckinEndpoint,
 			decodeRequest,
 			encodeResponse,
diff --git a/command/endpoint.go b/command/endpoint.go
index 5470531a..839cc874 100644
--- a/command/endpoint.go
+++ b/command/endpoint.go
@@ -1,6 +1,7 @@
 package command
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net/http"
@@ -10,7 +11,6 @@ import (
 	"github.com/go-kit/kit/log"
 	"github.com/go-kit/kit/metrics"
 	"github.com/micromdm/mdm"
-	"golang.org/x/net/context"
 )
 
 var errEmptyRequest = errors.New("request must contain UDID of the device")
diff --git a/command/transport_http.go b/command/transport_http.go
index 8f8d2713..10fb9604 100644
--- a/command/transport_http.go
+++ b/command/transport_http.go
@@ -1,13 +1,13 @@
 package command
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"io"
 	"net/http"
 
 	httptransport "github.com/go-kit/kit/transport/http"
-	"golang.org/x/net/context"
 )
 
 type HTTPHandlers struct {
@@ -17,7 +17,6 @@ type HTTPHandlers struct {
 func MakeHTTPHandlers(ctx context.Context, endpoints Endpoints, opts ...httptransport.ServerOption) HTTPHandlers {
 	h := HTTPHandlers{
 		NewCommandHandler: httptransport.NewServer(
-			ctx,
 			endpoints.NewCommandEndpoint,
 			decodeRequest,
 			encodeResponse,
@@ -39,24 +38,9 @@ type statuser interface {
 // The EncodeError should be passed to the Go-Kit httptransport as the
 // ServerErrorEncoder to encode error responses with JSON.
 func EncodeError(ctx context.Context, err error, w http.ResponseWriter) {
-	// unwrap Go-Kit Error
-	var domain string
-	if e, ok := err.(httptransport.Error); ok {
-		err = e.Err
-		domain = e.Domain
-	}
-
 	enc := json.NewEncoder(w)
 	enc.SetIndent("", "  ")
 
-	switch domain {
-	case httptransport.DomainDecode:
-		w.WriteHeader(http.StatusBadRequest)
-	case httptransport.DomainDo:
-		w.WriteHeader(http.StatusServiceUnavailable)
-	default:
-		w.WriteHeader(codeFromErr(err))
-	}
 	enc.Encode(map[string]interface{}{
 		"error": err.Error(),
 	})
diff --git a/enroll/endpoint.go b/enroll/endpoint.go
index 2bdf5cf5..3a6fac2f 100644
--- a/enroll/endpoint.go
+++ b/enroll/endpoint.go
@@ -1,8 +1,9 @@
 package enroll
 
 import (
+	"context"
+
 	"github.com/go-kit/kit/endpoint"
-	"golang.org/x/net/context"
 )
 
 type Endpoints struct {
diff --git a/enroll/transport.go b/enroll/transport.go
index 0eaf7b51..521ff5dc 100644
--- a/enroll/transport.go
+++ b/enroll/transport.go
@@ -1,10 +1,9 @@
 package enroll
 
 import (
+	"context"
 	"net/http"
 
-	"golang.org/x/net/context"
-
 	"github.com/go-kit/kit/log"
 	httptransport "github.com/go-kit/kit/transport/http"
 	"github.com/gorilla/mux"
@@ -18,9 +17,7 @@ func ServiceHandler(ctx context.Context, svc Service, logger log.Logger) http.Ha
 	opts := []httptransport.ServerOption{
 		httptransport.ServerErrorLogger(logger),
 	}
-
 	r.Methods("GET").Path("/mdm/enroll").Handler(httptransport.NewServer(
-		ctx,
 		e.GetEnrollEndpoint,
 		decodeMDMEnrollRequest,
 		encodeResponse,
diff --git a/lock.json b/lock.json
index fa59f824..ae808643 100644
--- a/lock.json
+++ b/lock.json
@@ -1,5 +1,5 @@
 {
-    "memo": "8ec26b54331ccbcbe914255b2e955a9f4aa1769f53accd011025f5ae2e986e4c",
+    "memo": "8f28fd12310c838617234aced70466223894111f2be4f1696581595e4403d1ae",
     "projects": [
         {
             "name": "github.com/RobotsAndPencils/buford",
@@ -21,8 +21,8 @@
         },
         {
             "name": "github.com/go-kit/kit",
-            "version": "v0.3.0",
-            "revision": "f66b0e13579bfc5a48b9e2a94b1209c107ea1f41",
+            "version": "v0.4.0",
+            "revision": "fadad6fffe0466b19df9efd9acde5c9a52df5fa4",
             "packages": [
                 "endpoint",
                 "log",
@@ -105,7 +105,7 @@
         {
             "name": "github.com/micromdm/scep",
             "branch": "master",
-            "revision": "576264a63d42bad5a423b870b3bde4f9f68320c1",
+            "revision": "a202afd5e358b857c95d048fc47432759db0d9bd",
             "packages": [
                 "depot",
                 "depot/bolt",
diff --git a/manifest.json b/manifest.json
index 6497748d..45495a7e 100644
--- a/manifest.json
+++ b/manifest.json
@@ -7,7 +7,7 @@
             "version": "v1.3.0"
         },
         "github.com/go-kit/kit": {
-            "version": "v0.3.0"
+            "version": "v0.4.0"
         },
         "github.com/gorilla/mux": {
             "version": "v1.3.0"
diff --git a/push/endpoint.go b/push/endpoint.go
index edd8a5dd..61dc1612 100644
--- a/push/endpoint.go
+++ b/push/endpoint.go
@@ -1,10 +1,10 @@
 package push
 
 import (
+	"context"
 	"errors"
 
 	"github.com/go-kit/kit/endpoint"
-	"golang.org/x/net/context"
 )
 
 var errEmptyRequest = errors.New("request must contain UDID of the device")
diff --git a/push/transport_http.go b/push/transport_http.go
index 76d47994..f85c9492 100644
--- a/push/transport_http.go
+++ b/push/transport_http.go
@@ -1,13 +1,13 @@
 package push
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"net/http"
 
 	httptransport "github.com/go-kit/kit/transport/http"
 	"github.com/gorilla/mux"
-	"golang.org/x/net/context"
 )
 
 type HTTPHandlers struct {
@@ -17,7 +17,6 @@ type HTTPHandlers struct {
 func MakeHTTPHandlers(ctx context.Context, endpoints Endpoints, opts ...httptransport.ServerOption) HTTPHandlers {
 	h := HTTPHandlers{
 		PushHandler: httptransport.NewServer(
-			ctx,
 			endpoints.PushEndpoint,
 			decodeRequest,
 			encodeResponse,
@@ -39,24 +38,9 @@ type statuser interface {
 // The EncodeError should be passed to the Go-Kit httptransport as the
 // ServerErrorEncoder to encode error responses with JSON.
 func EncodeError(ctx context.Context, err error, w http.ResponseWriter) {
-	// unwrap Go-Kit Error
-	var domain string
-	if e, ok := err.(httptransport.Error); ok {
-		err = e.Err
-		domain = e.Domain
-	}
-
 	enc := json.NewEncoder(w)
 	enc.SetIndent("", "  ")
 
-	switch domain {
-	case httptransport.DomainDecode:
-		w.WriteHeader(http.StatusBadRequest)
-	case httptransport.DomainDo:
-		w.WriteHeader(http.StatusServiceUnavailable)
-	default:
-		w.WriteHeader(codeFromErr(err))
-	}
 	enc.Encode(map[string]interface{}{
 		"error": err.Error(),
 	})
diff --git a/serve.go b/serve.go
index 6f5ae35f..eb4fb015 100644
--- a/serve.go
+++ b/serve.go
@@ -7,7 +7,6 @@ import (
 	"crypto/x509"
 	"encoding/asn1"
 	"encoding/pem"
-	"errors"
 	"flag"
 	"fmt"
 	"io/ioutil"
@@ -16,6 +15,7 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
+	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
@@ -29,6 +29,7 @@ import (
 	"github.com/go-kit/kit/log"
 	httptransport "github.com/go-kit/kit/transport/http"
 	"github.com/gorilla/mux"
+	"github.com/pkg/errors"
 
 	boltdepot "github.com/micromdm/scep/depot/bolt"
 	scep "github.com/micromdm/scep/server"
@@ -42,6 +43,8 @@ import (
 	nanopush "github.com/micromdm/nano/push"
 )
 
+const configDBPath = "/var/db/micromdm"
+
 func serve(args []string) error {
 	flagset := flag.NewFlagSet("serve", flag.ExitOnError)
 	var (
@@ -60,7 +63,7 @@ func serve(args []string) error {
 
 	logger := log.NewLogfmtLogger(os.Stderr)
 	stdlog.SetOutput(log.NewStdlibAdapter(logger)) // force structured logs
-	mainLogger := log.NewContext(logger).With("component", "main")
+	mainLogger := log.With(logger, "component", "main")
 	mainLogger.Log("msg", "started")
 
 	sm := &config{
@@ -69,6 +72,9 @@ func serve(args []string) error {
 		APNSPrivateKeyPass:  *flAPNSKeyPass,
 		APNSPrivateKeyPath:  *flAPNSKeyPath,
 	}
+	if err := os.MkdirAll(configDBPath, 0755); err != nil {
+		return errors.Wrapf(err, "creating config directory %s", configDBPath)
+	}
 	sm.setupPubSub()
 	sm.setupBolt()
 	sm.loadPushCerts()
@@ -88,7 +94,7 @@ func serve(args []string) error {
 	}
 
 	ctx := context.Background()
-	httpLogger := log.NewContext(logger).With("transport", "http")
+	httpLogger := log.With(logger, "transport", "http")
 	var checkinEndpoint endpoint.Endpoint
 	{
 		checkinEndpoint = checkin.MakeCheckinEndpoint(sm.checkinService)
@@ -147,7 +153,7 @@ func serve(args []string) error {
 	}()
 
 	go func() {
-		logger := log.NewContext(logger).With("transport", "HTTP")
+		logger := log.With(logger, "transport", "HTTP")
 		if !*flTLS {
 			var httpAddr = "0.0.0.0:8080"
 			logger.Log("addr", httpAddr)
@@ -278,7 +284,8 @@ func (c *config) setupBolt() {
 	if c.err != nil {
 		return
 	}
-	c.db, c.err = bolt.Open("mdm.db", 0777, nil)
+	dbPath := filepath.Join(configDBPath, "micromdm.db")
+	c.db, c.err = bolt.Open(dbPath, 0644, nil)
 	if c.err != nil {
 		return
 	}
@@ -404,7 +411,10 @@ func topicFromCert(cert *x509.Certificate) (string, error) {
 	return "", errors.New("could not find Push Topic (UserID OID) in certificate")
 }
 
-const scepCACertName = "SCEPCACert.pem"
+// TODO: refactor enroll service and remove the need to reference this cert.
+// but it might be useful to keep the PEM around for anyone who will need to export
+// the CA.
+const scepCACertName = "/var/db/micromdm/SCEPCACert.pem"
 
 func (c *config) setupSCEP(logger log.Logger) {
 	if c.err != nil {