diff --git a/src/appstore.js b/src/appstore.js
index 6fd7a0ddc..ca1b3a2dd 100644
--- a/src/appstore.js
+++ b/src/appstore.js
@@ -253,7 +253,7 @@ async function registerCloudron3(domain, version) {
 async function updateCloudron(data) {
     assert.strictEqual(typeof data, 'object');
 
-    const { domain } = data;
+    const { domain, version } = data;
 
     const token = await settings.get(settings.APPSTORE_API_TOKEN_KEY);
     if (!token) throw new BoxError(BoxError.LICENSE_ERROR, 'Missing token');
@@ -264,7 +264,7 @@ async function updateCloudron(data) {
 
     const [error, response] = await safe(superagent.post(`${await getApiServerOrigin()}/api/v1/update_cloudron`)
         .query(query)
-        .send({ domain })
+        .send({ domain, version })
         .timeout(60 * 1000)
         .ok(() => true));
 
diff --git a/src/mounts.js b/src/mounts.js
index 6ced7b125..4bcbc1555 100644
--- a/src/mounts.js
+++ b/src/mounts.js
@@ -68,6 +68,7 @@ function validateMountOptions(type, options) {
     case exports.MOUNT_TYPE_DISK:
     case exports.MOUNT_TYPE_LOOPBACK:
         if (typeof options.diskPath !== 'string') return new BoxError(BoxError.BAD_FIELD, 'diskPath is not a string');
+        // TODO: check if this diskPath is not mounted on '/' or somewhere dangerous
         return null;
     default:
         return new BoxError(BoxError.BAD_FIELD, 'Bad mount type');
diff --git a/src/routes/test/provision-test.js b/src/routes/test/provision-test.js
index 2c2e9fa15..9608a58b9 100644
--- a/src/routes/test/provision-test.js
+++ b/src/routes/test/provision-test.js
@@ -122,15 +122,21 @@ describe('Provision', function () {
     });
 
     describe('Activation', function () {
-        let scope1;
+        let scope1, scope2;
         before(async function () {
             scope1 = nock(await appstore.getApiServerOrigin())
                 .post('/api/v1/register_cloudron3', (body) => typeof body.domain === 'string' && typeof body.version === 'string')
                 .times(1000)
                 .reply(201, { cloudronId: '32', cloudronToken: 'xx' });
+
+            scope2 = nock(await appstore.getApiServerOrigin())
+                .post('/api/v1/update_cloudron?accessToken=xx', (body) => typeof body.domain === 'string' && typeof body.version === 'string')
+                .times(1000)
+                .reply(200, {});
         });
         after(function () {
             scope1.persist(false);
+            scope2.persist(false);
             nock.cleanAll();
         });
 
@@ -163,6 +169,8 @@ describe('Provision', function () {
                 .send({ username: '', password: owner.password, email: owner.email })
                 .ok(() => true);
 
+                console.log(response.body);
+
             expect(response.status).to.eql(400);
         });
 
diff --git a/src/storage/gcs.js b/src/storage/gcs.js
index 3e24d98a5..d39687f88 100644
--- a/src/storage/gcs.js
+++ b/src/storage/gcs.js
@@ -156,11 +156,10 @@ async function copy(apiConfig, fullFromPath, fullToPath, progressCallback) {
     if (copyError) throw new BoxError(BoxError.EXTERNAL_ERROR, copyError.message);
 }
 
-async function copyDir(apiConfig, fromPath, toPath, options, progressCallback) {
+async function copyDir(apiConfig, fromPath, toPath, progressCallback) {
     assert.strictEqual(typeof apiConfig, 'object');
     assert.strictEqual(typeof fromPath, 'string');
     assert.strictEqual(typeof toPath, 'string');
-    assert.strictEqual(typeof options, 'object');
     assert.strictEqual(typeof progressCallback, 'function');
 
     const batchSize = 1000;
diff --git a/src/system.js b/src/system.js
index cf1ec2a64..ea14de0ed 100644
--- a/src/system.js
+++ b/src/system.js
@@ -328,7 +328,7 @@ async function getBlockDevices() {
     const result = [];
     for (const device of devices) {
         const mountpoints = Array.isArray(device.mountpoints) ? device.mountpoints : [ device.mountpoint ]; // we only support one mountpoint here old lsblk only exposed one via .mountpoint
-        if (mountpoints.includes('/') || mountpoints.includes('/boot')) continue;
+        if (mountpoints.includes('/') || mountpoints.includes('/boot')) continue; // cannot be used for backups and volumes
 
         result.push({
             path: device.name,
diff --git a/src/test/storage-provider-test.js b/src/test/storage-provider-test.js
index e4301605c..1dc428861 100644
--- a/src/test/storage-provider-test.js
+++ b/src/test/storage-provider-test.js
@@ -223,6 +223,12 @@ describe('Storage', function () {
                 expect(cfg.region).to.be(backupConfig.region);
             }
 
+            async headObject(params) {
+                expect(params.Bucket).to.be(backupConfig.bucket);
+                const stat = await fs.promises.stat(path.join(bucketPathNoPrefix, params.Key));
+                return { ContentLength: stat.size };
+            }
+
             async listObjectsV2(params) {
                 expect(params.Bucket).to.be(backupConfig.bucket);
                 return {
@@ -238,10 +244,12 @@ describe('Storage', function () {
 
             async copyObject(params) {
                 // CopySource already has the bucket path!
+                const source = path.join(basePath, params.CopySource.replace(/%2B/g, '+'));
                 // Key already has prefix but no bucket ptah!
-                console.log('Copying:', path.join(basePath, params.CopySource), path.join(bucketPathNoPrefix, params.Key));
-                await fs.promises.mkdir(path.dirname(path.join(bucketPathNoPrefix, params.Key)), { recursive: true });
-                await fs.promises.copyFile(path.join(basePath, params.CopySource.replace(/%2B/g, '+')), path.join(bucketPathNoPrefix, params.Key));
+                const dest = path.join(bucketPathNoPrefix, params.Key);
+                console.log('Copying:', source, dest, path.dirname(dest));
+                await fs.promises.mkdir(path.dirname(dest), { recursive: true });
+                await fs.promises.copyFile(source, dest);
             }
 
             async deleteObject(params) {
@@ -301,7 +309,7 @@ describe('Storage', function () {
         it('can copy', async function () {
             fs.writeFileSync(path.join(bucketPath, 'uploadtest/C++.gitignore'), 'special', 'utf8');
 
-            await s3.copy(backupConfig, 'uploadtest', 'uploadtest-copy', () => {});
+            await s3.copyDir(backupConfig, 'uploadtest', 'uploadtest-copy', () => {});
             const sourceFile = path.join(__dirname, 'storage/data/test.txt');
             expect(fs.statSync(path.join(bucketPath, 'uploadtest-copy/test.txt')).size).to.be(fs.statSync(sourceFile).size);
             expect(fs.statSync(path.join(bucketPath, 'uploadtest-copy/C++.gitignore')).size).to.be(7);
@@ -438,7 +446,7 @@ describe('Storage', function () {
         it('can copy', async function () {
             fs.writeFileSync(path.join(bucketPath, 'uploadtest/C++.gitignore'), 'special', 'utf8');
 
-            await gcs.copy(backupConfig, 'uploadtest', 'uploadtest-copy', () => {});
+            await gcs.copyDir(backupConfig, 'uploadtest', 'uploadtest-copy', () => {});
             const sourceFile = path.join(__dirname, 'storage/data/test.txt');
             expect(fs.statSync(path.join(bucketPath, 'uploadtest-copy/test.txt')).size).to.be(fs.statSync(sourceFile).size);
             expect(fs.statSync(path.join(bucketPath, 'uploadtest-copy/C++.gitignore')).size).to.be(7);
diff --git a/src/test/system-test.js b/src/test/system-test.js
index 2af1fa30b..26c53dffe 100644
--- a/src/test/system-test.js
+++ b/src/test/system-test.js
@@ -78,7 +78,7 @@ describe('System', function () {
 
     it('can get block devices', async function () {
         const devices = await system.getBlockDevices();
-        expect(devices.some(d => d.mountpoint === '/')).to.be(true);
+        expect(devices).to.be.ok();
     });
 
     it('can get filesystems', async function () {