diff --git a/package/czechlight-rauc/rauc-hook.sh b/package/czechlight-rauc/rauc-hook.sh
index 5b14883..c701c3e 100755
--- a/package/czechlight-rauc/rauc-hook.sh
+++ b/package/czechlight-rauc/rauc-hook.sh
@@ -4,9 +4,14 @@
   slot-post-install)
     case "$RAUC_SLOT_CLASS" in
       cfg)
-        for DIR in etc random-seed ssh-user-auth; do
-          if [[ -d /cfg/$DIR ]]; then
-            cp -a /cfg/$DIR ${RAUC_SLOT_MOUNT_POINT}/
+        # whitelist so that we don't copy cruft or lost+found
+        for ITEM in \
+            etc \
+            random-seed \
+            ssh-user-auth \
+            ; do
+          if [[ -d /cfg/${ITEM} ]]; then
+            cp -a /cfg/${ITEM} ${RAUC_SLOT_MOUNT_POINT}/
           fi
         done
         ;;