diff --git a/bin/ghe-restore b/bin/ghe-restore
index c06f8507..42fe6cd5 100755
--- a/bin/ghe-restore
+++ b/bin/ghe-restore
@@ -285,6 +285,14 @@ fi
 # Get GHES release version in major.minor format
 RELEASE_VERSION=$(ghe-ssh "$GHE_HOSTNAME" -- 'ghe-config --get core.package-version' | cut -d '.' -f 1,2)
 
+# If the backup being restored is from an appliance with Actions disabled, restoring it onto an appliance with Actions enabled will cause
+# mismatches in the secrets needed for Actions which ultimately results in Actions not working properly. Note: xargs is to remove whitespace
+ACTIONS_ENABLED_IN_BACKUP=$(git config -f $GHE_RESTORE_SNAPSHOT_PATH/settings.json --bool app.actions.enabled | xargs)
+if [[ $ACTIONS_ENABLED_IN_BACKUP != true ]] && ghe-ssh "$GHE_HOSTNAME" -- 'ghe-config --true app.actions.enabled'; then
+    echo "Error: Restoring a backup with Actions disabled onto an appliance with Actions enabled is not supported." >&2
+    exit 1
+fi
+
 # Make sure the GitHub appliance has Actions enabled if the snapshot contains Actions data.
 # If above is true, also check if ac is present in appliance then snapshot should also contains ac databases
 if [ -d "$GHE_RESTORE_SNAPSHOT_PATH/mssql" ] || [ -d "$GHE_RESTORE_SNAPSHOT_PATH/actions" ]; then
diff --git a/test/test-ghe-restore.sh b/test/test-ghe-restore.sh
index 2e9ee3b1..6bef6bdc 100755
--- a/test/test-ghe-restore.sh
+++ b/test/test-ghe-restore.sh
@@ -6,6 +6,7 @@
 . "$(dirname "$0")/testlib.sh"
 
 setup_test_data "$GHE_DATA_DIR/1"
+setup_actions_enabled_settings_for_restore true
 
 # Make the current symlink
 ln -s 1 "$GHE_DATA_DIR/current"
@@ -700,3 +701,17 @@ end_test
 #     verify_all_restored_data
 # )
 # end_test
+
+begin_test "ghe-restore fails if Actions is disabled in the backup but enabled on the appliance"
+(
+  set -e
+  rm -rf "$GHE_REMOTE_ROOT_DIR"
+  setup_remote_metadata
+  setup_actions_enabled_settings_for_restore false
+  enable_actions
+
+  setup_maintenance_mode "configured"
+
+  ! ghe-restore -v -f localhost
+)
+end_test
diff --git a/test/testlib.sh b/test/testlib.sh
index 74fe6fae..32b57579 100644
--- a/test/testlib.sh
+++ b/test/testlib.sh
@@ -594,3 +594,11 @@ cleanup_moreutils_parallel() {
     unlink "$ROOTDIR/test/bin/parallel"
   fi
 }
+
+# setup_actions_enabled_in_settings_json writes settings for the Actions app to settings.json
+# it accepts true or false as first argument to enable or disable actions in settings.json
+setup_actions_enabled_settings_for_restore() {
+  # Empty the file, it now contains "fake ghe-export-settings data"
+  echo > "$GHE_DATA_DIR/1/settings.json"
+  git config -f "$GHE_DATA_DIR/1/settings.json" --bool app.actions.enabled $1
+}