diff --git a/rattail_fabric2/backup.py b/rattail_fabric2/backup.py
index c208573..2d3f460 100644
--- a/rattail_fabric2/backup.py
+++ b/rattail_fabric2/backup.py
@@ -97,7 +97,8 @@ def deploy_backup_app(c, deploy, envname, mkvirtualenv=True, user='rattail',
 
         # config
         c.sudo("bash -l -c 'workon {} && cdvirtualenv && rattail make-appdir'".format(envname), user=user)
-        deploy(c, config, os.path.join(envpath, 'app/rattail.conf'), owner=user, mode='0600', use_sudo=True, context=context)
+        # note, config is owned by root regardless of `user` - since we always run backups as root
+        deploy(c, config, os.path.join(envpath, 'app/rattail.conf'), owner='root', mode='0600', use_sudo=True, context=context)
         c.sudo("bash -l -c 'workon {} && cdvirtualenv && bin/rattail -c app/rattail.conf make-config -T quiet -O app/'".format(envname), user=user)
         c.sudo("bash -l -c 'workon {} && cdvirtualenv && bin/rattail -c app/rattail.conf make-config -T silent -O app/'".format(envname), user=user)