diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c
index de01d5b3c8..b7334eb16c 100644
--- a/servers/slapd/bconfig.c
+++ b/servers/slapd/bconfig.c
@@ -3992,6 +3992,11 @@ cfAddDatabase( CfEntryInfo *p, Entry *e, struct config_args_s *ca )
 	if ( p->ce_type != Cft_Global ) {
 		return LDAP_CONSTRAINT_VIOLATION;
 	}
+	/* config must be {0}, nothing else allowed */
+	if ( !strncmp( e->e_nname.bv_val, "olcDatabase={0}", STRLENOF("olcDatabase={0}")) &&
+		strcmp( e->e_nname.bv_val + STRLENOF("olcDatabase={0}"), "config" )) {
+		return LDAP_CONSTRAINT_VIOLATION;
+	}
 	ca->be = frontendDB;	/* just to get past check_vals */
 	return LDAP_SUCCESS;
 }