diff --git a/salt/common/tools/sbin/so-common b/salt/common/tools/sbin/so-common
index 03b19d756..0dfb19bbe 100755
--- a/salt/common/tools/sbin/so-common
+++ b/salt/common/tools/sbin/so-common
@@ -154,13 +154,11 @@ check_salt_minion_status() {
 	return $status
 }
 
-
-
 copy_new_files() {
   # Copy new files over to the salt dir
   cd $UPDATE_DIR
-  rsync -a salt $DEFAULT_SALT_DIR/
-  rsync -a pillar $DEFAULT_SALT_DIR/
+  rsync -a salt $DEFAULT_SALT_DIR/ --delete
+  rsync -a pillar $DEFAULT_SALT_DIR/ --delete
   chown -R socore:socore $DEFAULT_SALT_DIR/
   chmod 755 $DEFAULT_SALT_DIR/pillar/firewall/addfirewall.sh
   cd /tmp
diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 1251f9a57..8ec9f9bad 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -171,6 +171,13 @@ airgap_update_dockers() {
   fi
 }
 
+backup_old_states_pillars() {
+
+	tar czf /nsm/backup/$(echo $INSTALLEDVERSION)_$(date +%Y%m%d-%H%M%S)_soup_default_states_pillars.tar.gz /opt/so/saltstack/default/
+	tar czf /nsm/backup/$(echo $INSTALLEDVERSION)_$(date +%Y%m%d-%H%M%S)_soup_local_states_pillars.tar.gz /opt/so/saltstack/local/
+
+}
+
 update_registry() {
   docker stop so-dockerregistry
   docker rm so-dockerregistry
@@ -789,6 +796,7 @@ main() {
 
   if [ "$is_hotfix" == "true" ]; then
     echo "Applying $HOTFIXVERSION hotfix"
+    backup_old_states_pillars
     copy_new_files
     apply_hotfix
     echo "Hotfix applied"
@@ -845,6 +853,10 @@ main() {
       update_centos_repo
     fi
 
+    echo ""
+    echo "Creating snapshots of default and local Salt states and pillars and saving to /nsm/backup/"
+    backup_old_states_pillars
+
     echo ""
     echo "Copying new Security Onion code from $UPDATE_DIR to $DEFAULT_SALT_DIR."
     copy_new_files