diff --git a/_modules/scripts/backup.sh b/_modules/scripts/backup.sh
index e80d30d29..04f729d13 100644
--- a/_modules/scripts/backup.sh
+++ b/_modules/scripts/backup.sh
@@ -22,7 +22,12 @@ backup_failed() {
 # Whether to back up (asked with the other questions); the backup itself runs before the first change of the checkout
 backup_decide() {
   local output rc
-  RUN_BACKUP=
+  # exported: update.sh restarts itself after a branch switch, the decision and a backup already made stay
+  if [ "$MAILCOW_UPDATE_BACKUP_DECIDED" ]; then
+    return 0
+  fi
+  export MAILCOW_UPDATE_BACKUP_DECIDED=y
+  export RUN_BACKUP=
   if [ "$FORCE" ] && [ ! "$BACKUP" ]; then
     return 0
   fi
diff --git a/update.sh b/update.sh
index 0bc46b15c..9fc0bbefb 100755
--- a/update.sh
+++ b/update.sh
@@ -365,6 +365,16 @@ elif [ "$NEW_BRANCH" == "legacy" ] && [ "$CURRENT_BRANCH" != "legacy" ]; then
   git checkout -f "${BRANCH}"
 fi
 
+if [ ! "$DEV" ]; then
+  echo -e "\e[32mChecking for newer update script...\e[0m"
+  git fetch origin
+  git checkout "origin/${BRANCH}" -- update.sh
+  if [[ "$(sha256sum update.sh | awk '{print $1}')" != "${SCRIPT_HASH}" ]]; then
+    chmod +x update.sh
+    restart_update_script "update.sh has been updated"
+  fi
+fi
+
 if [ ! "$FORCE" ]; then
   read -r -p "Are you sure you want to update mailcow: dockerized? All containers will be stopped. [y/N] " response
   if [[ ! "${response}" =~ ^([yY][eE][sS]|[yY])+$ ]]; then
@@ -376,16 +386,6 @@ fi
 
 backup_run
 
-if [ ! "$DEV" ]; then
-  echo -e "\e[32mChecking for newer update script...\e[0m"
-  git fetch origin
-  git checkout "origin/${BRANCH}" -- update.sh
-  if [[ "$(sha256sum update.sh | awk '{print $1}')" != "${SCRIPT_HASH}" ]]; then
-    chmod +x update.sh
-    restart_update_script "update.sh has been updated"
-  fi
-fi
-
 echo -e "\e[32mValidating docker-compose stack configuration...\e[0m"
 sed -i 's/HTTPS_BIND:-:/HTTPS_BIND:-/g' docker-compose.yml
 sed -i 's/HTTP_BIND:-:/HTTP_BIND:-/g' docker-compose.yml