diff --git a/tools/apply-backup-bucket-policy.sh b/tools/apply-backup-bucket-policy.sh
index d9796ed..67895a0 100755
--- a/tools/apply-backup-bucket-policy.sh
+++ b/tools/apply-backup-bucket-policy.sh
@@ -134,6 +134,13 @@ client = boto3.client(
     aws_access_key_id=os.environ["AWS_ACCESS_KEY_ID"],
     aws_secret_access_key=os.environ["AWS_SECRET_ACCESS_KEY"],
 )
+current = json.loads(client.get_bucket_policy(Bucket=bucket)["Policy"])
+extra = sorted({item.get("Sid") for item in current.get("Statement", [])} - {item.get("Sid") for item in policy["Statement"]})
+if extra:
+    raise SystemExit(
+        "refusing to replace the bucket policy; live statements are not in this script: "
+        + ",".join(extra)
+    )
 client.put_bucket_policy(Bucket=bucket, Policy=json.dumps(policy))
 print("bucket_policy=put")
 got = client.get_bucket_policy(Bucket=bucket)