diff --git a/data/model/service_keys.py b/data/model/service_keys.py
index 4cfc30764..713b48442 100644
--- a/data/model/service_keys.py
+++ b/data/model/service_keys.py
@@ -15,9 +15,9 @@ def _expired_keys_clause(service):
 
 
 def _stale_unapproved_keys_clause(service):
-  return ((ServiceKey.service >> service) &
+  return ((ServiceKey.service == service) &
           (ServiceKey.approval >> None) &
-          (ServiceKey.created_date + UNAPPROVED_TTL) >= datetime.utcnow())
+          (ServiceKey.created_date <= (datetime.utcnow() - UNAPPROVED_TTL)))
 
 
 def _gc_expired(service):
@@ -118,7 +118,7 @@ def _list_service_keys_query(kid=None, service=None, approved_only=False):
 
   if service is not None:
     query = query.where(ServiceKey.service == service)
-    query = query.where(~(_expired_keys_clause(service)) &
+    query = query.where(~(_expired_keys_clause(service)) |
                         ~(_stale_unapproved_keys_clause(service)))
 
   if kid is not None: