I drill a pilot hole, then use a heavy wood screw or even lag screw and put silicone or roofing caulking in the pilot hole plus on the head after. I'm with you, water seems to get in the smallest of cracks and at the worst of times. Keep in mind that all your shingles are just nailed in, so it's not that big a deal.I'm surprised you just nail through the shingles into the decking -- I've always worked diligently to not poke holes in my roof!