diff --git a/package/base-files/files/etc/init.d/sysfixtime b/package/base-files/files/etc/init.d/sysfixtime
index ab946f6518f6..1354a586ce4e 100755
--- a/package/base-files/files/etc/init.d/sysfixtime
+++ b/package/base-files/files/etc/init.d/sysfixtime
@@ -10,8 +10,8 @@ HWCLOCK=/sbin/hwclock
 boot() {
 	start && exit 0
 
+	local maxtime="$(maxtime)"
 	local curtime="$(date +%s)"
-	local maxtime="$(find /etc -type f -exec date -r {} +%s \; | sort -nr | head -n1)"
 	[ $curtime -lt $maxtime ] && date -s @$maxtime
 }
 
@@ -23,3 +23,12 @@ stop() {
 	[ -e "$RTC_DEV" ] && [ -e "$HWCLOCK" ] && $HWCLOCK -w -f $RTC_DEV && \
 		logger -t sysfixtime "saved '$(date)' to $RTC_DEV"
 }
+
+maxtime() {
+	local file newest
+
+	for file in $( find /etc -type f ! -path /etc/dnsmasq.time ) ; do
+		[ -z "$newest" -o "$newest" -ot "$file"] && newest=$file
+	done
+	[ "$newest" ] && date -r "$newest" +%s
+}
diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index 3f12a40cd33f..f0aba1af44ea 100644
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -151,6 +151,8 @@ $(call Package/dnsmasq/install,$(1))
 ifneq ($(CONFIG_PACKAGE_dnsmasq_full_dnssec),)
 	$(INSTALL_DIR) $(1)/usr/share/dnsmasq
 	$(INSTALL_DATA) $(PKG_BUILD_DIR)/trust-anchors.conf $(1)/usr/share/dnsmasq
+	$(INSTALL_DIR) $(1)/lib/upgrade
+	$(INSTALL_BIN) ./files/dnsmasqsec-add-conffiles.sh $(1)/lib/upgrade
 endif
 endef
 
diff --git a/package/network/services/dnsmasq/files/dnsmasqsec-add-conffiles.sh b/package/network/services/dnsmasq/files/dnsmasqsec-add-conffiles.sh
new file mode 100644
index 000000000000..116ab5f8cf72
--- /dev/null
+++ b/package/network/services/dnsmasq/files/dnsmasqsec-add-conffiles.sh
@@ -0,0 +1,16 @@
+add_dnsmasqsec_conffiles()
+{
+	local filelist="$1"
+
+	# do NOT include timestamp in a backup, only system upgrade
+	# dnsmasq restart ensures file timestamp is up to date
+	if [ -z $NEED_IMAGE ]; then
+		if [ $(ubus call service list '{"name":"dnsmasq"}' | jsonfilter -e '@.*.instances.instance1.running') = "true" ]; then
+			/etc/init.d/dnsmasq restart
+			sleep 1
+			echo "/etc/dnsmasq.time" >>$filelist
+		fi
+	fi
+}
+
+sysupgrade_init_conffiles="$sysupgrade_init_conffiles add_dnsmasqsec_conffiles"