diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 9598823cb1..ff6dbc0871 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=base-files
-PKG_RELEASE:=58
+PKG_RELEASE:=59
 
 PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
 PKG_BUILD_DEPENDS:=opkg/host
@@ -54,6 +54,8 @@ define Package/base-files/conffiles
 /etc/shells
 /etc/sysctl.conf
 /etc/rc.local
+/etc/config/
+/etc/dropbear/
 $(call $(TARGET)/conffiles)
 endef
 
diff --git a/package/base-files/files/etc/sysupgrade.conf b/package/base-files/files/etc/sysupgrade.conf
new file mode 100644
index 0000000000..e06fd5e332
--- /dev/null
+++ b/package/base-files/files/etc/sysupgrade.conf
@@ -0,0 +1,5 @@
+## This file contains files and directories that should
+## be preserved during an upgrade.
+
+# /etc/example.conf
+# /etc/openvpn/
diff --git a/package/base-files/files/lib/upgrade/keep.d/base-files-essential b/package/base-files/files/lib/upgrade/keep.d/base-files-essential
new file mode 100644
index 0000000000..e35aae5090
--- /dev/null
+++ b/package/base-files/files/lib/upgrade/keep.d/base-files-essential
@@ -0,0 +1,10 @@
+# Essential files that will be always kept
+/etc/banner
+/etc/hosts
+/etc/inittab
+/etc/group
+/etc/passwd
+/etc/profile
+/etc/shells
+/etc/sysctl.conf
+/etc/rc.local
diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
index 1210e6e509..3d76bb3a0e 100755
--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@@ -55,8 +55,9 @@ EOF
 
 add_uci_conffiles() {
 	local file="$1"
-	( find /etc/config /etc/passwd /etc/group /etc/dropbear \
-		/etc/firewall.user /etc/rc.local -type f;
+	( find $(sed -ne '/^[[:space:]]*$/d; /^#/d; p' \
+		/etc/sysupgrade.conf /lib/upgrade/keep.d/* 2>/dev/null) \
+		-type f 2>/dev/null;
 	  opkg list-changed-conffiles ) | sort -u > "$file"
 	return 0
 }