diff --git a/backend/app.py b/backend/app.py
index 36defdc..6433660 100644
--- a/backend/app.py
+++ b/backend/app.py
@@ -421,6 +421,9 @@ async def reset_firegex(form: ResetRequest):
 @api.get('/export')
 async def export_db():
     """Export all configuration databases as JSON"""
+    # Block counters are written once a second; without this a backup misses the last ones.
+    from routers.services import firewall
+    firewall.flush_blocks()
     dbs = {}
     if not os.path.exists('db'):
         return dbs
diff --git a/tests/integration/test_backup.py b/tests/integration/test_backup.py
index 929bf7a..f29f6ab 100644
--- a/tests/integration/test_backup.py
+++ b/tests/integration/test_backup.py
@@ -130,8 +130,15 @@ def test_a_deleted_service_comes_back_whole_and_filtering(api, protected, filter
     _filters_as_configured(channel)
 
     # Read through the services API first, which writes the counters still waiting: what
-    # is compared afterwards includes them.
+    # is compared afterwards includes them. Until two reads agree, because on NFQUEUE a
+    # block reaches the backend after the client has already seen the refusal — one
+    # counted between this snapshot and the export failed the 5.0.0 release run.
     before = _snapshot(api, service_id)
+    for _ in range(10):
+        time.sleep(SETTLE)
+        before, settled = _snapshot(api, service_id), before
+        if before == settled:
+            break
     backup = api.export_backup()
 
     assert api.services_delete(service_id)