diff --git a/lib/src/services/user.dart b/lib/src/services/user.dart
index e66170b..a6fec0d 100644
--- a/lib/src/services/user.dart
+++ b/lib/src/services/user.dart
@@ -23,6 +23,13 @@ configureServer(Db db) {
       HookedServiceEvent.UPDATED,
       HookedServiceEvent.REMOVED
     ], hooks.disable());
+    
+    // Don't broadcast user events over WebSockets - they're sensitive data!
+    service.beforeAll((e) {
+      if (e.params == null)
+        e.params = {'broadcast': false};
+      else e.params['broadcast'] = false;
+    });
 
     // Validate new users, and also hash their passwords.
     service.beforeCreated