diff --git a/charts/mysqlha/templates/configmap.yaml b/charts/mysqlha/templates/configmap.yaml
index e516dcc..3cd064f 100644
--- a/charts/mysqlha/templates/configmap.yaml
+++ b/charts/mysqlha/templates/configmap.yaml
@@ -14,13 +14,15 @@ data:
     server-id=@@SERVER_ID@@
   create-replication-user.sh: |-
     #!/bin/bash
-
     mysql -h 127.0.0.1 --verbose -e "CREATE USER IF NOT EXISTS '${MYSQL_REPLICATION_USER}' IDENTIFIED BY '${MYSQL_REPLICATION_PASSWORD}';"
     retVal=$?
     if [ $retVal -ne 0 ]; then
       echo "error reported above so we need to retry..."
       mysql -h 127.0.0.1 --verbose -e "GRANT PROCESS, RELOAD, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO '${MYSQL_REPLICATION_USER}' IDENTIFIED BY '${MYSQL_REPLICATION_PASSWORD}';"
     else
-      mysql -h 127.0.0.1 --verbose -e "GRANT PROCESS, RELOAD, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO '${MYSQL_REPLICATION_USER}';"
+      mysql -h 127.0.0.1 --verbose -e "GRANT BACKUP_ADMIN, PROCESS, RELOAD, LOCK TABLES, REPLICATION SLAVE, REPLICATION CLIENT ON *.* TO '${MYSQL_REPLICATION_USER}';"
+      mysql -h 127.0.0.1 --verbose -e "GRANT SELECT ON performance_schema.log_status TO '${MYSQL_REPLICATION_USER}';"
+      mysql -h 127.0.0.1 --verbose -e "GRANT SELECT ON performance_schema.keyring_component_status TO '${MYSQL_REPLICATION_USER}';"
+      mysql -h 127.0.0.1 --verbose -e "GRANT SELECT ON performance_schema.replication_group_members TO '${MYSQL_REPLICATION_USER}';"
     fi
     mysql -h 127.0.0.1 --verbose -e "FLUSH PRIVILEGES;"
diff --git a/charts/mysqlha/templates/statefulset.yaml b/charts/mysqlha/templates/statefulset.yaml
index ce7e291..90f36cf 100644
--- a/charts/mysqlha/templates/statefulset.yaml
+++ b/charts/mysqlha/templates/statefulset.yaml
@@ -231,7 +231,7 @@ spec:
 
             # Start a server to send backups when requested by peers.
             exec ncat --listen --keep-open --send-only --max-conns=1 3307 -c \
-              "xtrabackup --backup --slave-info --stream=xbstream --host=127.0.0.1 --user=${MYSQL_REPLICATION_USER} --password=${MYSQL_REPLICATION_PASSWORD}"
+              "xtrabackup --backup --slave-info --safe-slave-backup --stream=xbstream --host=127.0.0.1 --user=${MYSQL_REPLICATION_USER} --password=${MYSQL_REPLICATION_PASSWORD}"
         volumeMounts:
         - name: data
           mountPath: /var/lib/mysql