diff --git a/src/include/ssp.h b/src/include/ssp.h
index c0f77d6..b2aa32f 100644
--- a/src/include/ssp.h
+++ b/src/include/ssp.h
@@ -67,7 +67,7 @@ ssize_t unesc(char *dst, size_t dlen, const char *sce, size_t slen);
 const char *get_site_name(const char *s, struct ssp *ctx);
 
 /* database.c */
-void rebuild_db(const char *oldkey, const char *newkey, struct otp *otp, struct ssp *ctx);
+void rebuild_db(const char *oldkey, const char *newkey, const struct otp *otp, struct ssp *ctx);
 int open_db(struct ssp *ctx);
 
 #define db_file(ctx)        (((ctx)->db) ? (ctx)->db : (ctx)->sa.s)
diff --git a/src/ssp/database.c b/src/ssp/database.c
index f440687..31d6906 100644
--- a/src/ssp/database.c
+++ b/src/ssp/database.c
@@ -99,7 +99,7 @@ open_db(struct ssp *ctx)
 }
 
 void
-rebuild_db(const char *oldkey, const char *newkey, struct otp *otp, struct ssp *ctx)
+rebuild_db(const char *oldkey, const char *newkey, const struct otp *otp, struct ssp *ctx)
 {
     size_t olen = 0, nlen;
     size_t vlen = sizeof(*otp) + otp->slen + strlen(otp->data + otp->slen) + 1;
@@ -119,21 +119,22 @@ rebuild_db(const char *oldkey, const char *newkey, struct otp *otp, struct ssp *
         int a = 0;
         db_reset(ctx);
         while ((r = db_next(ctx)) == 1) {
-            if (!a && olen && olen == ctx->key.len && !strcmp(oldkey, ctx->key.s)) {
-                /* replace otp */
-                if (!cdbmaker_sa_add(&mkr, ctx->key.s, ctx->key.len, (char *) otp, vlen))
-                    diefusys(EX_TEMPFAIL, "save database");
-                a = 1;
-            } else if (!a && !olen && nlen == ctx->key.len && !strcmp(newkey, ctx->key.s)) {
+            /* existing newkey isn't allowed when adding or renaming */
+            if (nlen == ctx->key.len && !strcmp(newkey, ctx->key.s)
+                    && (!olen || strcmp(oldkey, newkey))) {
                 diefu(EX_DATA_ERR, "add site ", ESC, newkey, ESC, ": Site already exists");
             } else {
-                if (!a && !olen && strcoll(ctx->key.s, newkey) > 0) {
+                if (!a && strcoll(ctx->key.s, newkey) > 0) {
                     /* insert otp at the right place */
                     if (!cdbmaker_sa_add(&mkr, newkey, nlen, (char *) otp, vlen))
                         diefusys(EX_TEMPFAIL, "save database");
                     a = 1;
                 }
-                if (!cdbmaker_sa_add(&mkr, ctx->key.s, ctx->key.len, ctx->val.s, ctx->val.len))
+                /* if current entry isn't the old one nor the new one, re-add */
+                if (!(olen == ctx->key.len && !strcmp(oldkey, ctx->key.s))
+                        && !(nlen == ctx->key.len && !strcmp(newkey, ctx->key.s))
+                        && !cdbmaker_sa_add(mkr, ctx->key.s, ctx->key.len,
+                                            ctx->val.s, ctx->val.len))
                     diefusys(EX_TEMPFAIL, "save database");
             }
         }