diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff60e38..a5dbdd5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ In Development
 * On multi-homed machines, Postfix now binds to the right network interface when sending outbound mail so that SPF checks on the receiving end will pass.
 * TLS certificate provisioning would crash if DNS propagation was in progress and a challenge failed; might have shown the wrong error when provisioning fails.
 * Backup times were displayed with the wrong time zone.
+* Backups to some AWS S3 regions broke in version 0.15 because we reverted the version of boto. That's now fixed.
 * On low-usage systems, don't hold backups for quite so long by taking a full backup more often.
 * Nightly status checks might fail if any domains had non-ASCII characters.
 * If domains need a TLS certificate and the user hasn't installed one yet using Let's Encrypt, the administrator would get a nightly email with weird interactive text asking them to agree to Let's Encrypt's ToS. Now just say that the provisioning can't be done automatically.
diff --git a/setup/management.sh b/setup/management.sh
index 7ec0459..271c692 100755
--- a/setup/management.sh
+++ b/setup/management.sh
@@ -4,12 +4,8 @@ source setup/functions.sh
 
 echo "Installing Mail-in-a-Box system management daemon..."
 
-# Switching python 2 boto to package manager's, not pypi's.
-if [ -f /usr/local/lib/python2.7/dist-packages/boto/__init__.py ]; then hide_output pip uninstall -y boto; fi
-
-# duplicity uses python 2 so we need to use the python 2 package of boto
 # build-essential libssl-dev libffi-dev python3-dev: Required to pip install cryptography.
-apt_install python3-flask links duplicity python-boto libyaml-dev python3-dnspython python3-dateutil \
+apt_install python3-flask links duplicity libyaml-dev python3-dnspython python3-dateutil \
 	build-essential libssl-dev libffi-dev python3-dev python-pip
 
 # Install other Python packages. The first line is the packages that Josh maintains himself!
@@ -18,6 +14,11 @@ hide_output pip3 install --upgrade \
 	"idna>=2.0.0" "cryptography>=1.0.2" boto psutil
 # email_validator is repeated in setup/questions.sh
 
+# duplicity uses python 2 so we need to get the python 2 package of boto to have backups to S3.
+# boto from the Ubuntu package manager is too out-of-date -- it doesn't support the newer
+# S3 api used in some regions, which breaks backups to those regions.  See #627, #653.
+hide_output pip install --upgrade boto
+
 # Create a backup directory and a random key for encrypting backups.
 mkdir -p $STORAGE_ROOT/backup
 if [ ! -f $STORAGE_ROOT/backup/secret_key.txt ]; then