diff --git a/cmd/juju/backups/restore.go b/cmd/juju/backups/restore.go
index f39f9538797..aa8101bc4b1 100644
--- a/cmd/juju/backups/restore.go
+++ b/cmd/juju/backups/restore.go
@@ -203,12 +203,14 @@ func (c *restoreCommand) getRebootstrapParams(
 		return nil, errors.Annotatef(err, "cannot enable provisioner-safe-mode")
 	}
 
-	controllerCfg := make(controller.Config)
+	controllerCfgAttrs := make(map[string]interface{})
 	for k, v := range config.ControllerConfig {
-		controllerCfg[k] = v
+		controllerCfgAttrs[k] = v
+	}
+	controllerCfg, err := controller.NewConfig(controllerDetails.ControllerUUID, meta.CACert, controllerCfgAttrs)
+	if err != nil {
+		return nil, errors.Annotatef(err, "cannot create controller config")
 	}
-	controllerCfg[controller.ControllerUUIDKey] = controllerDetails.ControllerUUID
-	controllerCfg[controller.CACertKey] = meta.CACert
 
 	return &restoreBootstrapParams{
 		controllerCfg,
diff --git a/cmd/juju/backups/restore_test.go b/cmd/juju/backups/restore_test.go
index 498088a2d57..34e9c5208cc 100644
--- a/cmd/juju/backups/restore_test.go
+++ b/cmd/juju/backups/restore_test.go
@@ -263,6 +263,42 @@ func (s *restoreSuite) TestRestoreReboostrapWritesUpdatedControllerInfo(c *gc.C)
 	})
 }
 
+func (s *restoreSuite) TestRestoreReboostrapControllerConfigDefaults(c *gc.C) {
+	metadata := params.BackupsMetadataResult{
+		CACert:       testing.CACert,
+		CAPrivateKey: testing.CAKey,
+	}
+	fakeEnv := fakeEnviron{}
+	s.command = backups.NewRestoreCommandForTest(
+		s.store, &mockRestoreAPI{},
+		func(string) (backups.ArchiveReader, *params.BackupsMetadataResult, error) {
+			return &mockArchiveReader{}, &metadata, nil
+		},
+		backups.GetEnvironFunc(fakeEnv),
+		nil,
+	)
+	boostrapped := false
+	s.PatchValue(&backups.BootstrapFunc, func(ctx environs.BootstrapContext, environ environs.Environ, args bootstrap.BootstrapParams) error {
+		c.Assert(args.ControllerConfig, jc.DeepEquals, controller.Config{
+			"controller-uuid":         "deadbeef-0bad-400d-8000-5b1d0d06f00d",
+			"ca-cert":                 testing.CACert,
+			"state-port":              37017,
+			"api-port":                17070,
+			"set-numa-control-policy": false,
+			"max-logs-age":            "72h",
+			"max-logs-size":           "4096M",
+			"max-txn-log-size":        "10M",
+			"auditing-enabled":        false,
+		})
+		boostrapped = true
+		return nil
+	})
+
+	_, err := cmdtesting.RunCommand(c, s.command, "restore", "-m", "testing:test1", "--file", "afile", "-b")
+	c.Assert(err, jc.ErrorIsNil)
+	c.Assert(boostrapped, jc.IsTrue)
+}
+
 func (s *restoreSuite) TestRestoreReboostrapBuiltInProvider(c *gc.C) {
 	metadata := params.BackupsMetadataResult{
 		CACert:       testing.CACert,