diff --git a/cmd/admin-heal-ops.go b/cmd/admin-heal-ops.go
index 1af92237d..c5fb9e176 100644
--- a/cmd/admin-heal-ops.go
+++ b/cmd/admin-heal-ops.go
@@ -784,6 +784,11 @@ func (h *healSequence) healDiskMeta(objAPI ObjectLayer) error {
 }
 
 func (h *healSequence) healItems(objAPI ObjectLayer, bucketsOnly bool) error {
+	if h.clientToken == bgHealingUUID {
+		// For background heal do nothing.
+		return nil
+	}
+
 	if err := h.healDiskMeta(objAPI); err != nil {
 		return err
 	}
diff --git a/cmd/common-main.go b/cmd/common-main.go
index 65bd9c751..e15045c35 100644
--- a/cmd/common-main.go
+++ b/cmd/common-main.go
@@ -766,6 +766,7 @@ func handleCommonEnvVars() {
 			logger.Info(color.RedBold(msg))
 		}
 		globalActiveCred = cred
+		globalCredViaEnv = true
 	} else {
 		globalActiveCred = auth.DefaultCredentials
 	}
diff --git a/cmd/config-migrate.go b/cmd/config-migrate.go
index d52741db0..b65b68b51 100644
--- a/cmd/config-migrate.go
+++ b/cmd/config-migrate.go
@@ -2531,6 +2531,12 @@ func readConfigWithoutMigrate(ctx context.Context, objAPI ObjectLayer) (config.C
 		}
 	}
 
+	if !globalCredViaEnv && cfg.Credential.IsValid() {
+		// Preserve older credential if we do not have
+		// root credentials set via environment variable.
+		globalActiveCred = cfg.Credential
+	}
+
 	// Init compression config. For future migration, Compression config needs to be copied over from previous version.
 	switch cfg.Version {
 	case "29":
diff --git a/cmd/globals.go b/cmd/globals.go
index 3acf67791..01eb14256 100644
--- a/cmd/globals.go
+++ b/cmd/globals.go
@@ -254,6 +254,9 @@ var (
 
 	globalActiveCred auth.Credentials
 
+	// Captures if root credentials are set via ENV.
+	globalCredViaEnv bool
+
 	globalPublicCerts []*x509.Certificate
 
 	globalDomainNames []string      // Root domains for virtual host style requests