diff --git a/src/features/service-install/hooks/backfill-device-service-environment-variable.ts b/src/features/service-install/hooks/backfill-device-service-environment-variable.ts
deleted file mode 100644
index ba5e9cf5d..000000000
--- a/src/features/service-install/hooks/backfill-device-service-environment-variable.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { hooks, errors, type sbvrUtils } from '@balena/pinejs';
-
-async function backfillDeviceAndService({
-	request,
-	api,
-}: sbvrUtils.HookArgs<'resin'>) {
-	const { service_install: siId } = request.values;
-
-	if (siId == null) {
-		return;
-	}
-
-	const si = await api.get({
-		resource: 'service_install',
-		id: siId,
-		options: {
-			$select: ['device', 'service'],
-		},
-	});
-
-	if (si == null) {
-		throw new errors.UnauthorizedError();
-	}
-
-	request.values.device = si.device.__id;
-	request.values.service = si.service.__id;
-}
-
-hooks.addPureHook('POST', 'resin', 'device_service_environment_variable', {
-	POSTPARSE: backfillDeviceAndService,
-});
-
-hooks.addPureHook('PATCH', 'resin', 'device_service_environment_variable', {
-	POSTPARSE: backfillDeviceAndService,
-});
diff --git a/src/features/service-install/hooks/backfill-service-install-on-device-service-env-var.ts b/src/features/service-install/hooks/backfill-service-install-on-device-service-env-var.ts
new file mode 100644
index 000000000..cf15a0dca
--- /dev/null
+++ b/src/features/service-install/hooks/backfill-service-install-on-device-service-env-var.ts
@@ -0,0 +1,58 @@
+import { hooks, errors, type sbvrUtils } from '@balena/pinejs';
+
+async function backfillServiceInstall({
+	request,
+	api,
+}: sbvrUtils.HookArgs<'resin'>) {
+	const { device: deviceId, service: serviceId } = request.values;
+
+	if (deviceId == null && serviceId == null) {
+		return;
+	}
+
+	if (
+		(deviceId == null && serviceId != null) ||
+		(deviceId != null && serviceId == null)
+	) {
+		throw new errors.BadRequestError(
+			'Both or none of device and service must be specified',
+		);
+	}
+
+	let si = await api.get({
+		resource: 'service_install',
+		id: {
+			device: deviceId,
+			installs__service: serviceId,
+		},
+		options: {
+			$select: ['id'],
+		},
+	});
+
+	if (si == null) {
+		si = await api.post({
+			resource: 'service_install',
+			body: {
+				device: deviceId,
+				installs__service: serviceId,
+			},
+		});
+	}
+
+	if (si == null) {
+		throw new errors.BadRequestError(
+			`No service install exists for device: ${deviceId} and service ${serviceId} and one could not be created`,
+		);
+	}
+
+	request.values.service_install = si.id;
+}
+
+hooks.addPureHook('POST', 'resin', 'device_service_environment_variable', {
+	POSTPARSE: backfillServiceInstall,
+});
+
+hooks.addPureHook('PATCH', 'resin', 'device_service_environment_variable', {
+	POSTPARSE: backfillServiceInstall,
+});
diff --git a/src/features/service-install/hooks/index.ts b/src/features/service-install/hooks/index.ts
index d089cbd91..740e23fb3 100644
--- a/src/features/service-install/hooks/index.ts
+++ b/src/features/service-install/hooks/index.ts
@@ -1 +1 @@
-import './backfill-device-service-environment-variable.js';
+import './backfill-service-install-on-device-service-env-var.js';
diff --git a/src/translations/v7/hooks.ts b/src/translations/v7/hooks.ts
index e69de29bb..742ad3a6b 100644
--- a/src/translations/v7/hooks.ts
+++ b/src/translations/v7/hooks.ts
@@ -0,0 +1,45 @@
+import { hooks, sbvrUtils, errors } from '@balena/pinejs';
+
+const addReadOnlyHook = (
+	methods: Array<Parameters<typeof hooks.addHook>[0]>,
+	resource: string,
+	hook: sbvrUtils.Hooks<'v7'>,
+) => {
+	methods.map((method) => {
+		hooks.addHook(method, 'v7', resource, {
+			...hook,
+			sideEffects: false,
+			readOnlyTx: true,
+		});
+	});
+};
+
+addReadOnlyHook(
+	['POST', 'PATCH', 'PUT'],
+	'device_service_environment_variable',
+	{
+		POSTPARSE: async ({ request, api }) => {
+			const { service_install: siId } = request.values;
+
+			if (siId == null) {
+				return;
+			}
+
+			const si = await sbvrUtils.api.resin.get({
+				resource: 'service_install',
+				passthrough: api.passthrough,
+				id: siId,
+				options: {
+					$select: ['device', 'service'],
+				},
+			});
+
+			if (si == null) {
+				throw new errors.UnauthorizedError();
+			}
+
+			request.values.device = si.device.__id;
+			request.values.service = si.service.__id;
+		},
+	},
+);
diff --git a/test/25_service-installs.ts b/test/25_service-installs.ts
index 9680a1207..5c9d8c06b 100644
--- a/test/25_service-installs.ts
+++ b/test/25_service-installs.ts
@@ -251,7 +251,9 @@ export default () => {
 						.post({
 							resource: 'device_service_environment_variable',
 							body: {
-								service_install: serviceInstall.id,
+								...(versions.lte(version, 'v7')
+									? { service_install: serviceInstall.id }
+									: { device: ctx.device.id, service: ctx.app2Service1.id }),
 								name: 'test',
 								value: '123',
 							},
diff --git a/test/test-lib/fixtures.ts b/test/test-lib/fixtures.ts
index 0ed0ca3ae..e5843dc5e 100644
--- a/test/test-lib/fixtures.ts
+++ b/test/test-lib/fixtures.ts
@@ -508,8 +508,8 @@ const loaders: types.Dictionary<LoaderFunc> = {
 			logErrorAndThrow(`Could not find service: ${jsonData.service}`);
 		}
 
-		const si = await expectToEventually(async () => {
-			const $si = await api.resin.get({
+		await expectToEventually(async () => {
+			const si = await api.resin.get({
 				resource: 'service_install',
 				passthrough: { req: permissions.rootRead },
 				id: {
@@ -517,14 +517,14 @@ const loaders: types.Dictionary<LoaderFunc> = {
 					installs__service: service.id,
 				},
 			});
-			assertExists($si);
-			return $si;
+			assertExists(si);
 		});
 
 		return await createResource({
 			resource: 'device_service_environment_variable',
 			body: {
-				service_install: si.id,
+				device: device.id,
+				service: service.id,
 				name: jsonData.name,
 				value: jsonData.value,
 			},