diff --git a/ct/kimai.sh b/ct/kimai.sh
index 87bcfb07a..95b1ca1b3 100644
--- a/ct/kimai.sh
+++ b/ct/kimai.sh
@@ -41,21 +41,19 @@ function update_script() {
     systemctl stop apache2
     msg_ok "Stopped Apache2"
 
-    msg_info "Backing up Kimai configuration and var directory"
-    mkdir -p "$BACKUP_DIR"
-    [ -d /opt/kimai/var ] && cp -r /opt/kimai/var "$BACKUP_DIR/"
-    [ -f /opt/kimai/.env ] && cp /opt/kimai/.env "$BACKUP_DIR/"
-    [ -f /opt/kimai/config/packages/local.yaml ] && cp /opt/kimai/config/packages/local.yaml "$BACKUP_DIR/"
-    msg_ok "Backup completed"
-
+    create_backup /opt/kimai/var \
+      /opt/kimai/.env \
+      /opt/kimai/config/packages/local.yaml
     fetch_and_deploy_gh_release "kimai" "kimai/kimai" "tarball"
+    restore_backup
 
     msg_info "Updating Kimai"
-    [ -d "$BACKUP_DIR/var" ] && cp -r "$BACKUP_DIR/var" /opt/kimai/
-    [ -f "$BACKUP_DIR/.env" ] && cp "$BACKUP_DIR/.env" /opt/kimai/
-    [ -f "$BACKUP_DIR/local.yaml" ] && cp "$BACKUP_DIR/local.yaml" /opt/kimai/config/packages/
-    rm -rf "$BACKUP_DIR"
-    cd /opt/kimai 
+    if grep -q "^APP_SECRET=$" /opt/kimai/.env; then
+      APP_SECRET=$(openssl rand -hex 48)
+      sed -i "s|^APP_SECRET=.*|APP_SECRET=${APP_SECRET}|" /opt/kimai/.env
+    fi
+
+    cd /opt/kimai
     sed -i '/^admin_lte:/,/^[^[:space:]]/d' config/packages/local.yaml
     $STD composer install --no-dev --optimize-autoloader
     $STD bin/console kimai:update
diff --git a/install/kimai-install.sh b/install/kimai-install.sh
index e555a8489..f506369a0 100644
--- a/install/kimai-install.sh
+++ b/install/kimai-install.sh
@@ -44,12 +44,14 @@ msg_ok "Set up database"
 fetch_and_deploy_gh_release "kimai" "kimai/kimai" "tarball"
 
 msg_info "Setup Kimai"
+APP_SECRET=$(openssl rand -hex 48)
 cd /opt/kimai
 echo "export COMPOSER_ALLOW_SUPERUSER=1" >>~/.bashrc
 source ~/.bashrc
 $STD composer install --no-dev --optimize-autoloader --no-interaction
 cp .env.dist .env
-sed -i "/^DATABASE_URL=/c\DATABASE_URL=mysql://$DB_USER:$DB_PASS@127.0.0.1:3306/$DB_NAME?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
+sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://$DB_USER:$DB_PASS@127.0.0.1:3306/$DB_NAME?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
+sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env
 $STD bin/console kimai:install -n
 $STD expect <<EOF
 set timeout -1