diff --git a/NetworkManager.spec b/NetworkManager.spec
index ff729e6..892c8fd 100644
--- a/NetworkManager.spec
+++ b/NetworkManager.spec
@@ -16,7 +16,7 @@ Name: NetworkManager
 Summary: Network connection manager and user applications
 Epoch: 1
 Version: 0.7.0
-Release: 0.11.%{snapshot}.2%{?dist}
+Release: 0.11.%{snapshot}.3%{?dist}
 Group: System Environment/Base
 License: GPLv2+
 URL: http://www.gnome.org/projects/NetworkManager/
@@ -28,6 +28,7 @@ Patch4: serial-debug.patch
 Patch5: explain-dns1-dns2.patch
 Patch6: wpa-adhoc-fix.patch
 Patch7: crypto-init.patch
+Patch8: nm-vpn-fixes-r900-r901.patch
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 PreReq:   chkconfig
@@ -150,6 +151,7 @@ tar -xzf %{SOURCE1}
 %patch5 -p1 -b .explain-dns1-dns2
 %patch6 -p1 -b .wpa-adhoc-fix
 %patch7 -p1 -b .crypto-init
+%patch8 -p1 -b .vpn-fixes
 
 %build
 autoreconf -i
@@ -304,6 +306,9 @@ fi
 %{_datadir}/gtk-doc/html/libnm-glib/
 
 %changelog
+* Tue Sep 30 2008 Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn4022.3
+- Fix handling of VPN settings on upgrade (rh #460730, bgo #553465)
+
 * Thu Sep 11 2008 Dan Williams <dcbw@redhat.com> - 1:0.7.0-0.11.svn4022.2
 - Fix hang when reading system connections from ifcfg files
 
diff --git a/nm-vpn-fixes-r900-r901.patch b/nm-vpn-fixes-r900-r901.patch
new file mode 100644
index 0000000..7f79c2c
--- /dev/null
+++ b/nm-vpn-fixes-r900-r901.patch
@@ -0,0 +1,88 @@
+2008-09-24  Dan Williams  <dcbw@redhat.com>
+
+	* src/gconf-helpers/gconf-upgrade.c
+		- (nm_gconf_migrate_0_7_vpn_properties): don't set empty values in GConf
+		- (move_one_vpn_string_bool, move_one_vpn_string_string): fix stray
+			semicolon that caused values to not get converted and removed
+			(second part of fix for bgo #553465)
+
+2008-09-24  Dan Williams  <dcbw@redhat.com>
+
+	* src/gconf-helpers/gconf-helpers.c
+		- (nm_gconf_get_stringhash_helper, write_properties_stringhash): do not
+			read or write empty values (partial fix for bgo #553465)
+
+
+diff -up NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-helpers.c.vpn-fixes NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-helpers.c
+--- NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-helpers.c.vpn-fixes	2008-08-22 00:04:31.000000000 -0400
++++ NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-helpers.c	2008-09-30 16:36:47.000000000 -0400
+@@ -447,9 +447,11 @@ nm_gconf_get_stringhash_helper (GConfCli
+ 		} else {
+ 			GConfValue *gc_val = gconf_entry_get_value (entry);
+ 
+-			if (gc_val && gconf_value_get_string (gc_val)) {
+-				g_hash_table_insert (*value, gconf_unescape_key (gc_key, -1),
+-				                     g_strdup (gconf_value_get_string (gc_val)));
++			if (gc_val) {
++				const char *gc_str = gconf_value_get_string (gc_val);
++
++				if (gc_str && strlen (gc_str))
++					g_hash_table_insert (*value, gconf_unescape_key (gc_key, -1), g_strdup (gc_str));
+ 			}
+ 		}
+ 		gconf_entry_free (entry);
+@@ -764,10 +766,14 @@ write_properties_stringhash (gpointer ke
+ 	WritePropertiesInfo *info = (WritePropertiesInfo *) user_data;
+ 	char *esc_key;
+ 	char *full_key;
++	const char *str_value = (const char *) value;
++
++	if (!str_value || !strlen (str_value))
++		return;
+ 
+ 	esc_key = gconf_escape_key ((char *) key, -1);
+ 	full_key = g_strconcat (info->path, "/", esc_key, NULL);
+-	gconf_client_set_string (info->client, full_key, (char *) value, NULL);
++	gconf_client_set_string (info->client, full_key, (char *) str_value, NULL);
+ 	g_free (esc_key);
+ 	g_free (full_key);
+ }
+diff -up NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-upgrade.c.vpn-fixes NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-upgrade.c
+--- NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-upgrade.c.vpn-fixes	2008-08-25 23:05:16.000000000 -0400
++++ NetworkManager-0.7.0/nm-applet-0.7.0/src/gconf-helpers/gconf-upgrade.c	2008-09-30 16:36:47.000000000 -0400
+@@ -1197,10 +1197,13 @@ nm_gconf_migrate_0_7_vpn_properties (GCo
+ 
+ 			switch (entry->value->type) {
+ 			case GCONF_VALUE_STRING:
+-				nm_gconf_set_string_helper (client, (const char *) iter->data,
+-				                            key_name,
+-				                            NM_SETTING_VPN_SETTING_NAME,
+-				                            gconf_value_get_string (entry->value));
++				tmp = (char *) gconf_value_get_string (entry->value);
++				if (tmp && strlen (tmp)) {
++					nm_gconf_set_string_helper (client, (const char *) iter->data,
++					                            key_name,
++					                            NM_SETTING_VPN_SETTING_NAME,
++					                            gconf_value_get_string (entry->value));
++				}
+ 				break;
+ 			case GCONF_VALUE_INT:
+ 				tmp = g_strdup_printf ("%d", gconf_value_get_int (entry->value));
+@@ -1247,7 +1250,7 @@ move_one_vpn_string_bool (GConfClient *c
+ 	if (!nm_gconf_get_string_helper (client, path,
+ 	                                 old_key,
+ 	                                 NM_SETTING_VPN_SETTING_NAME,
+-	                                 &value));
++	                                 &value))
+ 		return;
+ 
+ 	if (value && !strcmp (value, "yes")) {
+@@ -1279,7 +1282,7 @@ move_one_vpn_string_string (GConfClient 
+ 	if (!nm_gconf_get_string_helper (client, path,
+ 	                                 old_key,
+ 	                                 NM_SETTING_VPN_SETTING_NAME,
+-	                                 &value));
++	                                 &value))
+ 		return;
+ 
+ 	if (value && strlen (value)) {