diff --git a/src/pipewire/impl-client.c b/src/pipewire/impl-client.c
index 2e83a3e0a..74aa127d3 100644
--- a/src/pipewire/impl-client.c
+++ b/src/pipewire/impl-client.c
@@ -132,12 +132,47 @@ static int client_error(void *object, uint32_t id, int res, const char *error)
 	return 0;
 }
 
+static int update_properties(struct pw_impl_client *client, const struct spa_dict *dict, bool filter)
+{
+	struct pw_resource *resource;
+	int changed = 0;
+	uint32_t i;
+
+        for (i = 0; i < dict->n_items; i++) {
+		if (filter && strstr(dict->items[i].key, "pipewire.") == dict->items[i].key &&
+		    pw_properties_get(client->properties, dict->items[i].key) != NULL) {
+			pw_log_warn(NAME" %p: refuse property update '%s' to '%s'",
+					client, dict->items[i].key, dict->items[i].value);
+			continue;
+		}
+                changed += pw_properties_set(client->properties, dict->items[i].key, dict->items[i].value);
+	}
+	client->info.props = &client->properties->dict;
+
+	pw_log_debug(NAME" %p: updated %d properties", client, changed);
+
+	if (!changed)
+		return 0;
+
+	client->info.change_mask |= PW_CLIENT_CHANGE_MASK_PROPS;
+
+	pw_impl_client_emit_info_changed(client, &client->info);
+
+	if (client->global)
+		spa_list_for_each(resource, &client->global->resource_list, link)
+			pw_client_resource_info(resource, &client->info);
+
+	client->info.change_mask = 0;
+
+	return changed;
+}
+
 static int client_update_properties(void *object, const struct spa_dict *props)
 {
 	struct pw_resource *resource = object;
 	struct resource_data *data = pw_resource_get_user_data(resource);
 	struct pw_impl_client *client = data->client;
-	return pw_impl_client_update_properties(client, props);
+	return update_properties(client, props, true);
 }
 
 static int client_get_permissions(void *object, uint32_t index, uint32_t num)
@@ -555,28 +590,7 @@ const struct pw_client_info *pw_impl_client_get_info(struct pw_impl_client *clie
 SPA_EXPORT
 int pw_impl_client_update_properties(struct pw_impl_client *client, const struct spa_dict *dict)
 {
-	struct pw_resource *resource;
-	int changed;
-
-	changed = pw_properties_update(client->properties, dict);
-	client->info.props = &client->properties->dict;
-
-	pw_log_debug(NAME" %p: updated %d properties", client, changed);
-
-	if (!changed)
-		return 0;
-
-	client->info.change_mask |= PW_CLIENT_CHANGE_MASK_PROPS;
-
-	pw_impl_client_emit_info_changed(client, &client->info);
-
-	if (client->global)
-		spa_list_for_each(resource, &client->global->resource_list, link)
-			pw_client_resource_info(resource, &client->info);
-
-	client->info.change_mask = 0;
-
-	return changed;
+	return update_properties(client, dict, false);
 }
 
 SPA_EXPORT
diff --git a/src/pipewire/keys.h b/src/pipewire/keys.h
index 570282b85..19c1e38ca 100644
--- a/src/pipewire/keys.h
+++ b/src/pipewire/keys.h
@@ -39,19 +39,7 @@ extern "C" {
  * Properties from other objects can also appear. This usually suggests some
  * sort of parent/child or owner/owned relationship.
  */
-
-/* Peroperties usually set on the core object */
-#define PW_KEY_USER_NAME		"pipewire.user-name"	/**< The user name that runs pipewire */
-#define PW_KEY_HOST_NAME		"pipewire.host-name"	/**< The host name of the machine */
-#define PW_KEY_CORE_NAME		"pipewire.core.name"	/**< The name of the core. Default is
-								  *  pipewire-<user-name>-<pid> */
-#define PW_KEY_CORE_VERSION		"pipewire.core.version"	/**< The version of the core. */
-#define PW_KEY_CORE_DAEMON		"pipewire.core.daemon"	/**< If the core is listening for connections. */
-
-/** The protocol key is usually set on a pw_client and contains a
- * string describing the protocol used by the client to access
- * PipeWire */
-#define PW_KEY_PROTOCOL			"pipewire.protocol"
+#define PW_KEY_PROTOCOL			"pipewire.protocol"	/**< protocol used for connection */
 #define PW_KEY_ACCESS			"pipewire.access"	/**< how the client access is controlled */
 
 /** Various keys related to the identity of a client process and its security.
@@ -71,8 +59,15 @@ extern "C" {
 
 /* context */
 #define PW_KEY_CONTEXT_PROFILE_MODULES	"context.profile.modules"	/**< a context profile for modules */
+#define PW_KEY_USER_NAME		"context.user-name"	/**< The user name that runs pipewire */
+#define PW_KEY_HOST_NAME		"context.host-name"	/**< The host name of the machine */
 
 /* core */
+#define PW_KEY_CORE_NAME		"core.name"		/**< The name of the core. Default is
+								  *  pipewire-<user-name>-<pid> */
+#define PW_KEY_CORE_VERSION		"core.version"		/**< The version of the core. */
+#define PW_KEY_CORE_DAEMON		"core.daemon"		/**< If the core is listening for connections. */
+
 #define PW_KEY_CORE_ID			"core.id"		/**< the core id */
 #define PW_KEY_CORE_MONITORS		"core.monitors"		/**< the apis monitored by core. */