diff --git a/serial/commands_backup.c b/serial/commands_backup.c
index ea18467..e0fd05f 100644
--- a/serial/commands_backup.c
+++ b/serial/commands_backup.c
@@ -66,10 +66,10 @@ void cmd_import_keys(int argc, char **argv) {
         return;
     }
 
-    // Backup first
-    printf("backing up current keys...\r\n");
-    cmd_export_keys(0, NULL);
-
+    // M15: the safety-backup is emitted ONCE, later — only after the pasted blob
+    // has been received and base64-decoded (see "backing up current keys" below).
+    // The old unconditional backup here ran even when the import turned out to be
+    // empty/garbage, so it was removed.
     printf("paste import data, then send empty line:\r\n");
 
     // Read base64 directly from serial into a large static buffer
diff --git a/serial/commands_system.c b/serial/commands_system.c
index 4b92f9e..bdd3cac 100644
--- a/serial/commands_system.c
+++ b/serial/commands_system.c
@@ -64,11 +64,13 @@ void cmd_status(int argc, char **argv) {
         printf("ntp:       not synced\r\n");
     }
 
-    // Keys (admin only: key inventory is target-selection data)
+    // Keys (admin only: key inventory is target-selection data). Declared at
+    // function scope so the scrub below always runs, even on the non-admin path
+    // where the array stays zero-initialised.
+    static key_record_t keys[BACKUP_MAX_KEYS];
     if (commands_is_admin()) {
-        static key_record_t keys[BACKUP_MAX_KEYS];
-        int                 count   = storage_key_list(keys, BACKUP_MAX_KEYS);
-        int                 enabled = 0, corrupt = 0;
+        int count   = storage_key_list(keys, BACKUP_MAX_KEYS);
+        int enabled = 0, corrupt = 0;
         for (int i = 0; i < count; i++) {
             if (!keys[i].is_checksum_valid)
                 corrupt++;