diff --git a/CHANGES b/CHANGES
index d1dfebf25..ac318f354 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1788,4 +1788,5 @@
 * Setup logrotate configs for collectd since upstream does not set it up
 * mail: Add X-Envelope-To and X-Envelope-From headers for incoming mails
 * linode: add object storage backend
+* restore: carefully replace backup config
 
diff --git a/src/provision.js b/src/provision.js
index e1f5fcb66..800b5ffd4 100644
--- a/src/provision.js
+++ b/src/provision.js
@@ -221,7 +221,7 @@ function restore(backupConfig, backupId, version, sysinfoConfig, auditSource, ca
                     backups.restore.bind(null, backupConfig, backupId, (progress) => setProgress('restore', progress.message, NOOP_CALLBACK)),
                     settings.setSysinfoConfig.bind(null, sysinfoConfig),
                     cloudron.setupDashboard.bind(null, auditSource, (progress) => setProgress('restore', progress.message, NOOP_CALLBACK)),
-                    settings.setBackupConfig.bind(null, backupConfig), // update with the latest backupConfig
+                    settings.setBackupCredentials.bind(null, backupConfig), // update just the credentials and not the policy and flags
                     eventlog.add.bind(null, eventlog.ACTION_RESTORE, auditSource, { backupId }),
                 ], function (error) {
                     gProvisionStatus.restore.active = false;
diff --git a/src/settings.js b/src/settings.js
index 264871b94..ec2e6a909 100644
--- a/src/settings.js
+++ b/src/settings.js
@@ -24,6 +24,7 @@ exports = module.exports = {
 
     getBackupConfig: getBackupConfig,
     setBackupConfig: setBackupConfig,
+    setBackupCredentials: setBackupCredentials,
 
     getPlatformConfig: getPlatformConfig,
     setPlatformConfig: setPlatformConfig,
@@ -412,6 +413,30 @@ function setBackupConfig(backupConfig, callback) {
     });
 }
 
+function setBackupCredentials(credentials, callback) {
+    assert.strictEqual(typeof credentials, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    getBackupConfig(function (error, currentConfig) {
+        if (error) return callback(error);
+
+        // preserve these fields
+        const extra = _.pick(currentConfig, 'retentionSecs', 'intervalSecs', 'copyConcurrency', 'syncConcurrency');
+
+        const backupConfig = _.extend({}, credentials, extra);
+
+        backups.cleanupCacheFilesSync();
+
+        settingsdb.set(exports.BACKUP_CONFIG_KEY, JSON.stringify(backupConfig), function (error) {
+            if (error) return callback(error);
+
+            notifyChange(exports.BACKUP_CONFIG_KEY, backupConfig);
+
+            backups.configureCollectd(backupConfig, callback);
+        });
+    });
+}
+
 function getPlatformConfig(callback) {
     assert.strictEqual(typeof callback, 'function');
 
@@ -458,10 +483,10 @@ function setExternalLdapConfig(externalLdapConfig, callback) {
     assert.strictEqual(typeof externalLdapConfig, 'object');
     assert.strictEqual(typeof callback, 'function');
 
-    getExternalLdapConfig(function (error, curentConfig) {
+    getExternalLdapConfig(function (error, currentConfig) {
         if (error) return callback(error);
 
-        externalLdap.injectPrivateFields(externalLdapConfig, curentConfig);
+        externalLdap.injectPrivateFields(externalLdapConfig, currentConfig);
 
         externalLdap.testConfig(externalLdapConfig, function (error) {
             if (error) return callback(error);