diff --git a/config/common.mk b/config/common.mk
index 73e7559..f4e890f 100644
--- a/config/common.mk
+++ b/config/common.mk
@@ -32,6 +32,10 @@
     vendor/slim/prebuilt/common/bin/99-backup.sh:system/addon.d/99-backup.sh \
     vendor/slim/prebuilt/common/etc/backup.conf:system/etc/backup.conf
 
+# Signature compatibility validation
+PRODUCT_COPY_FILES += \
+    vendor/slim/prebuilt/common/bin/otasigcheck.sh:system/bin/otasigcheck.sh
+
 # SLIM-specific init file
 PRODUCT_COPY_FILES += \
     vendor/slim/prebuilt/common/etc/init.local.rc:root/init.slim.rc
diff --git a/prebuilt/common/bin/backuptool.functions b/prebuilt/common/bin/backuptool.functions
index 833460f..10d66a4 100644
--- a/prebuilt/common/bin/backuptool.functions
+++ b/prebuilt/common/bin/backuptool.functions
@@ -5,7 +5,7 @@
 
 export C=/tmp/backupdir
 export S=/system
-export V=9
+export V=12
 
 backup_file() {
   if [ -e "$1" ]; then
diff --git a/prebuilt/common/bin/backuptool.sh b/prebuilt/common/bin/backuptool.sh
index 9e67f48..7b3e39d 100755
--- a/prebuilt/common/bin/backuptool.sh
+++ b/prebuilt/common/bin/backuptool.sh
@@ -5,7 +5,7 @@
 
 export C=/tmp/backupdir
 export S=/system
-export V=Slim-4.4
+export V=Slim-5.0
 
 # Preserve /system/addon.d in /tmp/addon.d
 preserve_addon_d() {
@@ -20,14 +20,44 @@
   rm -rf /tmp/addon.d/
 }
 
-# Check for proper Slim version
-check_version() {
-  if ( ! grep -q "ro.slim.version=$V.*" /system/build.prop); then
-    echo "Not running backup from incompatible version"
-    exit
+# Proceed only if /system is the expected major and minor version
+check_prereq() {
+if ( ! grep -q "^ro.slim.version=$V.*" /system/build.prop ); then
+  echo "Not backing up files from incompatible version: $V"
+  return 0
+fi
+return 1
+}
+
+check_blacklist() {
+  if [ -f /system/addon.d/blacklist ];then
+      ## Discard any known bad backup scripts
+      cd /$1/addon.d/
+      for f in *sh; do
+          s=$(md5sum $f | awk {'print $1'})
+          grep -q $s /system/addon.d/blacklist && rm -f $f
+      done
   fi
 }
 
+check_whitelist() {
+  found=0
+  if [ -f /system/addon.d/whitelist ];then
+      ## forcefully keep any version-independent stuff
+      cd /$1/addon.d/
+      for f in *sh; do
+          s=$(md5sum $f | awk {'print $1'})
+          grep -q $s /system/addon.d/whitelist
+          if [ $? -eq 0 ]; then
+              found=1
+          else
+              rm -f $f
+          fi
+      done
+  fi
+  return $found
+}
+
 # Execute /system/addon.d/*.sh scripts with $1 parameter
 run_stage() {
 for script in $(find /tmp/addon.d/ -name '*.sh' |sort -n); do
@@ -37,15 +67,25 @@
 
 case "$1" in
   backup)
-    check_version
     mkdir -p $C
+    if check_prereq; then
+        if check_whitelist system; then
+            exit 127
+        fi
+    fi
+    check_blacklist system
     preserve_addon_d
     run_stage pre-backup
     run_stage backup
     run_stage post-backup
   ;;
   restore)
-    check_version
+    if check_prereq; then
+        if check_whitelist tmp; then
+            exit 127
+        fi
+    fi
+    check_blacklist tmp
     run_stage pre-restore
     run_stage restore
     run_stage post-restore
diff --git a/prebuilt/common/bin/blacklist b/prebuilt/common/bin/blacklist
new file mode 100644
index 0000000..03c36c4
--- /dev/null
+++ b/prebuilt/common/bin/blacklist
@@ -0,0 +1,4 @@
+80f99c594f7b82c4cbe533e3f5447729
+29f4bab6bae5959458678869350dc888
+77d73f73da664f3592e712b7e7c107c1
+a5019b358023a3a6ae8be3f3380ba5ca
diff --git a/prebuilt/common/bin/otasigcheck.sh b/prebuilt/common/bin/otasigcheck.sh
new file mode 100644
index 0000000..7bf1228
--- /dev/null
+++ b/prebuilt/common/bin/otasigcheck.sh
@@ -0,0 +1,25 @@
+#!/sbin/sh
+
+# Validate that the incoming OTA is compatible with an already-installed
+# system
+
+grep -q "Command:.*\"--wipe\_data\"" /tmp/recovery.log
+if [ $? -eq 0 ]; then
+  echo "Data will be wiped after install; skipping signature check..."
+  exit 0
+fi
+
+if [ -f /data/system/packages.xml -a -f /tmp/releasekey ]; then
+  relCert=$(grep -A3 'package name="com.android.htmlviewer"' /data/system/packages.xml  | grep "cert index" | head -n 1 | sed -e 's|.*"\([[:digit:]][[:digit:]]*\)".*|\1|g')
+
+  # Tools missing? Err on the side of caution and exit cleanly
+  if [ "z$relCert" == "z" ]; then exit 0; fi
+
+  grep "cert index=\"$relCert\"" /data/system/packages.xml | grep -q `cat /tmp/releasekey`
+  if [ $? -ne 0 ]; then
+     echo "You have an installed system that isn't signed with this build's key, aborting..."
+     exit 124
+  fi
+fi
+
+exit 0
diff --git a/prebuilt/common/bin/whitelist b/prebuilt/common/bin/whitelist
new file mode 100644
index 0000000..ca3f017
--- /dev/null
+++ b/prebuilt/common/bin/whitelist
@@ -0,0 +1 @@
+b0a27bcb5c7504a81e1450a8313e37cb