protect config files on update