diff --git a/src/ahriman/application/handlers/backup.py b/src/ahriman/application/handlers/backup.py
index 864783ea..d302b2f6 100644
--- a/src/ahriman/application/handlers/backup.py
+++ b/src/ahriman/application/handlers/backup.py
@@ -81,11 +81,13 @@ class Backup(Handler):
         Returns:
             set[Path]: map of the filesystem paths
         """
-        paths = set(configuration.include.glob("*.ini"))
-
+        # configuration files
         root, _ = configuration.check_loaded()
-        paths.add(root)  # the configuration itself
-        paths.add(SQLite.database_path(configuration))  # database
+        paths = set(configuration.includes)
+        paths.add(root)
+
+        # database
+        paths.add(SQLite.database_path(configuration))
 
         # local caches
         repository_paths = configuration.repository_paths
diff --git a/src/ahriman/application/handlers/restore.py b/src/ahriman/application/handlers/restore.py
index 6c4834eb..9dfde12d 100644
--- a/src/ahriman/application/handlers/restore.py
+++ b/src/ahriman/application/handlers/restore.py
@@ -47,7 +47,7 @@ class Restore(Handler):
             report(bool): force enable or disable reporting
         """
         with tarfile.open(args.path) as archive:
-            archive.extractall(path=args.output)  # nosec
+            archive.extractall(path=args.output, filter="data")
 
     @staticmethod
     def _set_repo_restore_parser(root: SubParserAction) -> argparse.ArgumentParser:
diff --git a/tests/ahriman/application/handlers/test_handler_restore.py b/tests/ahriman/application/handlers/test_handler_restore.py
index 9ccb0d42..e91e6bcf 100644
--- a/tests/ahriman/application/handlers/test_handler_restore.py
+++ b/tests/ahriman/application/handlers/test_handler_restore.py
@@ -34,7 +34,7 @@ def test_run(args: argparse.Namespace, configuration: Configuration, mocker: Moc
 
     _, repository_id = configuration.check_loaded()
     Restore.run(args, repository_id, configuration, report=False)
-    extract_mock.extractall.assert_called_once_with(path=args.output)
+    extract_mock.extractall.assert_called_once_with(path=args.output, filter="data")
 
 
 def test_disallow_multi_architecture_run() -> None: