diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
index d4fd005f59..844ae396a0 100644
--- a/tools/xenstore/xenstored_core.c
+++ b/tools/xenstore/xenstored_core.c
@@ -2018,7 +2018,8 @@ static int tdb_flags;
 static void manual_node(const char *name, const char *child)
 {
 	struct node *node;
-	struct xs_permissions perms = { .id = 0, .perms = XS_PERM_NONE };
+	struct xs_permissions perms = { .id = dom0_domid,
+					.perms = XS_PERM_NONE };
 
 	node = talloc_zero(NULL, struct node);
 	if (!node)
@@ -2057,7 +2058,7 @@ static void tdb_logger(TDB_CONTEXT *tdb, int level, const char * fmt, ...)
 	}
 }
 
-static void setup_structure(bool live_update)
+void setup_structure(bool live_update)
 {
 	char *tdbname;
 
@@ -2080,6 +2081,7 @@ static void setup_structure(bool live_update)
 		manual_node("/", "tool");
 		manual_node("/tool", "xenstored");
 		manual_node("/tool/xenstored", NULL);
+		domain_entry_fix(dom0_domid, 3, true);
 	}
 
 	check_store();
@@ -2598,9 +2600,6 @@ int main(int argc, char *argv[])
 
 	init_pipe(reopen_log_pipe);
 
-	/* Setup the database */
-	setup_structure(live_update);
-
 	/* Listen to hypervisor. */
 	if (!no_domain_init && !live_update) {
 		domain_init(-1);
diff --git a/tools/xenstore/xenstored_core.h b/tools/xenstore/xenstored_core.h
index 9c572a3c6e..a772f3b8ea 100644
--- a/tools/xenstore/xenstored_core.h
+++ b/tools/xenstore/xenstored_core.h
@@ -231,6 +231,7 @@ int write_node_raw(struct connection *conn, TDB_DATA *key, struct node *node,
 struct node *read_node(struct connection *conn, const void *ctx,
 		       const char *name);
 
+void setup_structure(bool live_update);
 struct connection *new_connection(const struct interface_funcs *funcs);
 struct connection *get_connection_by_id(unsigned int conn_id);
 void check_store(void);
diff --git a/tools/xenstore/xenstored_domain.c b/tools/xenstore/xenstored_domain.c
index 44ce267ec5..5c79eed3dc 100644
--- a/tools/xenstore/xenstored_domain.c
+++ b/tools/xenstore/xenstored_domain.c
@@ -496,6 +496,9 @@ static struct domain *introduce_domain(const void *ctx,
 		}
 		domain->interface = interface;
 
+		if (is_master_domain)
+			setup_structure(restore);
+
 		/* Now domain belongs to its connection. */
 		talloc_steal(domain->conn, domain);