diff --git a/builtin/credential/aws/backend.go b/builtin/credential/aws/backend.go
index 30feba9ca..cb1c97017 100644
--- a/builtin/credential/aws/backend.go
+++ b/builtin/credential/aws/backend.go
@@ -99,6 +99,9 @@ func Backend(conf *logical.BackendConfig) (*backend, error) {
 			LocalStorage: []string{
 				"whitelist/identity/",
 			},
+			SealWrapStorage: []string{
+				"config/client",
+			},
 		},
 		Paths: []*framework.Path{
 			pathLogin(b),
diff --git a/builtin/credential/ldap/backend.go b/builtin/credential/ldap/backend.go
index 08af4c77c..909990573 100644
--- a/builtin/credential/ldap/backend.go
+++ b/builtin/credential/ldap/backend.go
@@ -31,6 +31,10 @@ func Backend() *backend {
 			Unauthenticated: []string{
 				"login/*",
 			},
+
+			SealWrapStorage: []string{
+				"config",
+			},
 		},
 
 		Paths: append([]*framework.Path{
diff --git a/builtin/credential/okta/backend.go b/builtin/credential/okta/backend.go
index eab2c7ce5..e91d66358 100644
--- a/builtin/credential/okta/backend.go
+++ b/builtin/credential/okta/backend.go
@@ -25,6 +25,9 @@ func Backend() *backend {
 			Unauthenticated: []string{
 				"login/*",
 			},
+			SealWrapStorage: []string{
+				"config",
+			},
 		},
 
 		Paths: append([]*framework.Path{
diff --git a/builtin/credential/radius/backend.go b/builtin/credential/radius/backend.go
index 49dcb7f6f..c986ff9dc 100644
--- a/builtin/credential/radius/backend.go
+++ b/builtin/credential/radius/backend.go
@@ -26,6 +26,10 @@ func Backend() *backend {
 				"login",
 				"login/*",
 			},
+
+			SealWrapStorage: []string{
+				"config",
+			},
 		},
 
 		Paths: append([]*framework.Path{
diff --git a/builtin/logical/aws/backend.go b/builtin/logical/aws/backend.go
index b6341e062..c76a95e85 100644
--- a/builtin/logical/aws/backend.go
+++ b/builtin/logical/aws/backend.go
@@ -25,6 +25,9 @@ func Backend() *backend {
 			LocalStorage: []string{
 				framework.WALPrefix,
 			},
+			SealWrapStorage: []string{
+				"config/root",
+			},
 		},
 
 		Paths: []*framework.Path{
diff --git a/builtin/logical/cassandra/backend.go b/builtin/logical/cassandra/backend.go
index dd54ba5b4..906ad72c5 100644
--- a/builtin/logical/cassandra/backend.go
+++ b/builtin/logical/cassandra/backend.go
@@ -25,6 +25,12 @@ func Backend() *backend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/connection",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigConnection(&b),
 			pathRoles(&b),
diff --git a/builtin/logical/consul/backend.go b/builtin/logical/consul/backend.go
index 9fd09ac81..74551320c 100644
--- a/builtin/logical/consul/backend.go
+++ b/builtin/logical/consul/backend.go
@@ -16,6 +16,12 @@ func Factory(conf *logical.BackendConfig) (logical.Backend, error) {
 func Backend() *backend {
 	var b backend
 	b.Backend = &framework.Backend{
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/access",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigAccess(),
 			pathListRoles(&b),
diff --git a/builtin/logical/database/backend.go b/builtin/logical/database/backend.go
index ffc1a40aa..a8a54a7cd 100644
--- a/builtin/logical/database/backend.go
+++ b/builtin/logical/database/backend.go
@@ -28,6 +28,12 @@ func Backend(conf *logical.BackendConfig) *databaseBackend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/*",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathListPluginConnection(&b),
 			pathConfigurePluginConnection(&b),
diff --git a/builtin/logical/mongodb/backend.go b/builtin/logical/mongodb/backend.go
index d850e8aa8..860f5785f 100644
--- a/builtin/logical/mongodb/backend.go
+++ b/builtin/logical/mongodb/backend.go
@@ -24,6 +24,12 @@ func Backend() *framework.Backend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/connection",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigConnection(&b),
 			pathConfigLease(&b),
diff --git a/builtin/logical/mssql/backend.go b/builtin/logical/mssql/backend.go
index ccd981bad..5cdeb3a32 100644
--- a/builtin/logical/mssql/backend.go
+++ b/builtin/logical/mssql/backend.go
@@ -24,6 +24,12 @@ func Backend() *backend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/connection",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigConnection(&b),
 			pathConfigLease(&b),
diff --git a/builtin/logical/mysql/backend.go b/builtin/logical/mysql/backend.go
index a89cc49de..18be6ecd0 100644
--- a/builtin/logical/mysql/backend.go
+++ b/builtin/logical/mysql/backend.go
@@ -24,6 +24,12 @@ func Backend() *backend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/connection",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigConnection(&b),
 			pathConfigLease(&b),
diff --git a/builtin/logical/postgresql/backend.go b/builtin/logical/postgresql/backend.go
index 4a689f899..2d509d351 100644
--- a/builtin/logical/postgresql/backend.go
+++ b/builtin/logical/postgresql/backend.go
@@ -25,6 +25,12 @@ func Backend(conf *logical.BackendConfig) *backend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/connection",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigConnection(&b),
 			pathConfigLease(&b),
diff --git a/builtin/logical/rabbitmq/backend.go b/builtin/logical/rabbitmq/backend.go
index 1e3f1ec06..e66e5796c 100644
--- a/builtin/logical/rabbitmq/backend.go
+++ b/builtin/logical/rabbitmq/backend.go
@@ -26,6 +26,12 @@ func Backend() *backend {
 	b.Backend = &framework.Backend{
 		Help: strings.TrimSpace(backendHelp),
 
+		PathsSpecial: &logical.Paths{
+			SealWrapStorage: []string{
+				"config/connection",
+			},
+		},
+
 		Paths: []*framework.Path{
 			pathConfigConnection(&b),
 			pathConfigLease(&b),