diff --git a/src/cloudron.js b/src/cloudron.js
index d9ee15aa4..9ba6f4542 100644
--- a/src/cloudron.js
+++ b/src/cloudron.js
@@ -10,6 +10,7 @@ exports = module.exports = {
     isRebootRequired,
 
     onActivated,
+    onRestored,
 
     setupDnsAndCert,
 
@@ -27,6 +28,7 @@ const apps = require('./apps.js'),
     assert = require('assert'),
     AuditSource = require('./auditsource.js'),
     backups = require('./backups.js'),
+    backuptask = require('./backuptask.js'),
     BoxError = require('./boxerror.js'),
     branding = require('./branding.js'),
     constants = require('./constants.js'),
@@ -83,6 +85,24 @@ async function onActivated(options) {
     await reverseProxy.writeDefaultConfig({ activated :true });
 }
 
+async function onRestored(options) {
+    assert.strictEqual(typeof options, 'object');
+
+    debug('onRestored: downloading mail');
+
+    const [error, results] = await safe(backups.getByIdentifierAndStatePaged(backups.BACKUP_IDENTIFIER_MAIL, backups.BACKUP_STATE_NORMAL, 1, 1));
+    if (error || results.length == 0) {
+        debug('startMail: could not find backup to restore', error, results);
+    } else {
+        debug(`startMail: downloading backup ${results[0].id}`);
+        const restoreConfig = { backupId: results[0].id, backupFormat: results[0].format };
+        // have to wait for download before starting mail container because we download as non-root user
+        await backuptask.downloadMail(restoreConfig, (progress) => debug(`startMail: ${progress.message}`));
+    }
+
+    await onActivated(options);
+}
+
 async function notifyUpdate() {
     const version = safe.fs.readFileSync(paths.VERSION_FILE, 'utf8');
     if (version === constants.VERSION) return;
diff --git a/src/mail.js b/src/mail.js
index e2148a0e1..75605cc64 100644
--- a/src/mail.js
+++ b/src/mail.js
@@ -69,8 +69,6 @@ exports = module.exports = {
 };
 
 const assert = require('assert'),
-    backups = require('./backups.js'),
-    backuptask = require('./backuptask.js'),
     BoxError = require('./boxerror.js'),
     cloudron = require('./cloudron.js'),
     constants = require('./constants.js'),
@@ -754,18 +752,6 @@ async function restartMail() {
 async function startMail(existingInfra) {
     assert.strictEqual(typeof existingInfra, 'object');
 
-    if (existingInfra.version === 'none') {
-        const [error, results] = await safe(backups.getByIdentifierAndStatePaged(backups.BACKUP_IDENTIFIER_MAIL, backups.BACKUP_STATE_NORMAL, 1, 1));
-        if (error || results.length == 0) {
-            debug('startMail: could not find backup to restore', error, results);
-        } else {
-            debug(`startMail: downloading backup ${results[0].id}`);
-            const restoreConfig = { backupId: results[0].id, backupFormat: results[0].format };
-            // have to wait for download before starting mail container because we download as non-root user
-            await backuptask.downloadMail(restoreConfig, (progress) => debug(`startMail: ${progress.message}`));
-        }
-    }
-
     await restartMail();
 }
 
diff --git a/src/provision.js b/src/provision.js
index 73de06fae..d30d32e7a 100644
--- a/src/provision.js
+++ b/src/provision.js
@@ -161,7 +161,7 @@ async function restoreTask(backupConfig, backupId, sysinfoConfig, options, audit
         await settings.setBackupCredentials(backupConfig); // update just the credentials and not the policy and flags
         await eventlog.add(eventlog.ACTION_RESTORE, auditSource, { backupId });
 
-        setImmediate(() => safe(cloudron.onActivated(options), { debug }));
+        setImmediate(() => safe(cloudron.onRestored(options), { debug }));
     } catch (error) {
         gProvisionStatus.restore.errorMessage = error ? error.message : '';
     }
diff --git a/src/services.js b/src/services.js
index 6e862ea8f..626f194a5 100644
--- a/src/services.js
+++ b/src/services.js
@@ -399,7 +399,7 @@ async function configureService(id, data, auditSource) {
         await apps.update(instance, { servicesConfig });
     } else if (SERVICES[name]) {
         const servicesConfig = await settings.getServicesConfig();
-        needsRebuild = servicesConfig[name]?.recoveryMode != data.recoveryMode; // intentional != since 'debug' may or may not be there
+        needsRebuild = servicesConfig[name]?.recoveryMode != data.recoveryMode; // intentional != since 'recoveryMode' may or may not be there
         servicesConfig[name] = data;
 
         await settings.setServicesConfig(servicesConfig);
@@ -407,6 +407,8 @@ async function configureService(id, data, auditSource) {
         throw new BoxError(BoxError.NOT_FOUND, 'No such service');
     }
 
+    debug(`configureService: ${id} rebuild=${needsRebuild}`);
+
     // do this in background
     if (needsRebuild) {
         safe(rebuildService(id, auditSource), { debug });
@@ -519,6 +521,9 @@ async function rebuildService(id, auditSource) {
     case 'graphite':
         await startGraphite({ version: 'none' });
         break;
+    case 'mail':
+        await mail.startMail({ version: 'none' });
+        break;
     default:
         // nothing to rebuild for now.
     }
@@ -771,7 +776,7 @@ async function applyMemoryLimit(id) {
         throw new BoxError(BoxError.NOT_FOUND, 'No such service');
     }
 
-    debug(`updateServiceConfig: ${containerName} ${JSON.stringify(serviceConfig)}`);
+    debug(`applyMemoryLimit: ${containerName} ${JSON.stringify(serviceConfig)}`);
 
     const memory = system.getMemoryAllocation(memoryLimit);
     await docker.update(containerName, memory, memoryLimit);