diff --git a/main.go b/main.go
index d2709f8..c2ae719 100644
--- a/main.go
+++ b/main.go
@@ -311,27 +311,30 @@ func parseStream(r io.Reader, cb func(netip.Prefix)) error {
 // -----------------------------------------------------------------------------
 
 func subscribeKeyspace(ctx context.Context, rdb *redis.Client, ranger *Ranger) {
-	pubsub := rdb.PSubscribe(ctx, "__keyspace@0__:bl:*", "__keyspace@0__:wl:*")
+	// listen to keyevent channels (not keyspace) so msg.Payload == actual key
+	patterns := []string{
+		"__keyevent@0__:set",
+		"__keyevent@0__:del",
+		"__keyevent@0__:expired",
+	}
+	pubsub := rdb.PSubscribe(ctx, patterns...)
 	go func() {
 		for msg := range pubsub.Channel() {
-			fmt.Println(msg)
-			key := strings.TrimPrefix(msg.Channel, "__keyspace@0__:")
-			payload := msg.Payload
-			if strings.HasPrefix(key, "wl:") {
+			key := msg.Payload // full redis key e.g. "wl:1.2.3.4" or "bl:spam:10.0.0.0/8"
+			switch {
+			case strings.HasPrefix(key, "wl:"):
 				ipStr := strings.TrimPrefix(key, "wl:")
 				addr, err := netip.ParseAddr(ipStr)
 				if err != nil {
 					continue
 				}
-				switch payload {
-				case "set":
+				switch msg.Channel {
+				case "__keyevent@0__:set":
 					ranger.addWhite(addr)
-				case "del", "expired":
+				case "__keyevent@0__:del", "__keyevent@0__:expired":
 					ranger.removeWhite(addr)
 				}
-				continue
-			}
-			if strings.HasPrefix(key, "bl:") {
+			case strings.HasPrefix(key, "bl:"):
 				parts := strings.SplitN(key, ":", 3)
 				if len(parts) != 3 {
 					continue
@@ -341,10 +344,10 @@ func subscribeKeyspace(ctx context.Context, rdb *redis.Client, ranger *Ranger) {
 				if err != nil {
 					continue
 				}
-				switch payload {
-				case "set":
+				switch msg.Channel {
+				case "__keyevent@0__:set":
 					ranger.addBlock(cat, p)
-				case "del", "expired":
+				case "__keyevent@0__:del", "__keyevent@0__:expired":
 					ranger.removeBlock(cat, p)
 				}
 			}