diff --git a/scripts/decrypt b/scripts/decrypt
index 92e5af58..df551378 100755
--- a/scripts/decrypt
+++ b/scripts/decrypt
@@ -102,8 +102,10 @@ if ! gpg -d "${TARGZ}".gpg > "${TARGZ}" ; then
   log_error "Error while decrypting ${TARGZ}.gpg"
   RC=1
 else
-  cd / # important to extract files at according place
-  if tar zxf "${TARGZ}" ; then
+  # For backwards compatibility we switch to the root directory, for old
+  # encrypted tarballs that stripped the leading /.
+  cd /
+  if tar zxPf "${TARGZ}" ; then
     log_info "Successfully restored configuration archive ${TARGZ}.gpg"
     log_info "Now you should be able to run 'ngcpcfg apply' again."
   else
diff --git a/scripts/encrypt b/scripts/encrypt
index 1edd145f..6e49b074 100755
--- a/scripts/encrypt
+++ b/scripts/encrypt
@@ -30,8 +30,8 @@ get_config_file_list() {
       # if the file does not exist (e.g. because "ngcpcfg apply"
       # hasn't been executed yet for whatever reason, then don't
       # report missing files, otherwise tar will complain
-      if [ -r "/${y}" ] ; then
-        echo "/${y}"
+      if [ -r "${y}" ] ; then
+        echo "${y}"
       fi
     done
   done
@@ -61,7 +61,7 @@ fi
 
 TARGZ=/etc/ngcp-config-crypted.tgz
 
-tar zcf "${TARGZ}" /etc/ngcp-config/ "${FILES[@]}" /etc/.git
+tar zcPf "${TARGZ}" /etc/ngcp-config/ "${FILES[@]}" /etc/.git
 if gpg --symmetric "${TARGZ}" ; then
   log_info "Successfully created encrypted ngcpcfg configuration archive ${TARGZ}.gpg"
   # ensure we don't leave the unencrypted version behind