diff --git a/src/settings/nm-settings-connection.c b/src/settings/nm-settings-connection.c
index 79e8458968..9e0dd3e74d 100644
--- a/src/settings/nm-settings-connection.c
+++ b/src/settings/nm-settings-connection.c
@@ -510,18 +510,12 @@ connection_changed_cb (NMSettingsConnection *self, gpointer unused)
 	_emit_updated (self, FALSE);
 }
 
-/* Update the settings of this connection to match that of 'new_connection',
- * taking care to make a private copy of secrets.
- */
 gboolean
-nm_settings_connection_replace_settings (NMSettingsConnection *self,
-                                         NMConnection *new_connection,
-                                         gboolean update_unsaved,
-                                         const char *log_diff_name,
-                                         GError **error)
+nm_settings_connection_replace_settings_prepare (NMSettingsConnection *self,
+                                                 NMConnection *new_connection,
+                                                 GError **error)
 {
 	NMSettingsConnectionPrivate *priv;
-	gboolean success = FALSE;
 
 	g_return_val_if_fail (NM_IS_SETTINGS_CONNECTION (self), FALSE);
 	g_return_val_if_fail (NM_IS_CONNECTION (new_connection), FALSE);
@@ -540,6 +534,30 @@ nm_settings_connection_replace_settings (NMSettingsConnection *self,
 		return FALSE;
 	}
 
+	return TRUE;
+}
+
+gboolean
+nm_settings_connection_replace_settings_full (NMSettingsConnection *self,
+                                              NMConnection *new_connection,
+                                              gboolean prepare_new_connection,
+                                              gboolean update_unsaved,
+                                              const char *log_diff_name,
+                                              GError **error)
+{
+	NMSettingsConnectionPrivate *priv;
+
+	g_return_val_if_fail (NM_IS_SETTINGS_CONNECTION (self), FALSE);
+	g_return_val_if_fail (NM_IS_CONNECTION (new_connection), FALSE);
+
+	priv = NM_SETTINGS_CONNECTION_GET_PRIVATE (self);
+
+	if (   prepare_new_connection
+	    && !nm_settings_connection_replace_settings_prepare (self,
+	                                                         new_connection,
+	                                                         error))
+		return FALSE;
+
 	/* Do nothing if there's nothing to update */
 	if (nm_connection_compare (NM_CONNECTION (self),
 	                           new_connection,
@@ -567,7 +585,6 @@ nm_settings_connection_replace_settings (NMSettingsConnection *self,
 	 * nm_connection_clear_secrets() and clears them.
 	 */
 	update_system_secrets_cache (self);
-	success = TRUE;
 
 	/* Add agent and always-ask secrets back; they won't necessarily be
 	 * in the replacement connection data if it was eg reread from disk.
@@ -594,7 +611,25 @@ nm_settings_connection_replace_settings (NMSettingsConnection *self,
 
 	_emit_updated (self, TRUE);
 
-	return success;
+	return TRUE;
+}
+
+/* Update the settings of this connection to match that of 'new_connection',
+ * taking care to make a private copy of secrets.
+ */
+gboolean
+nm_settings_connection_replace_settings (NMSettingsConnection *self,
+                                         NMConnection *new_connection,
+                                         gboolean update_unsaved,
+                                         const char *log_diff_name,
+                                         GError **error)
+{
+	return nm_settings_connection_replace_settings_full (self,
+	                                                     new_connection,
+	                                                     TRUE,
+	                                                     update_unsaved,
+	                                                     log_diff_name,
+	                                                     error);
 }
 
 gboolean
diff --git a/src/settings/nm-settings-connection.h b/src/settings/nm-settings-connection.h
index c1e368a298..8c2ccb0e7f 100644
--- a/src/settings/nm-settings-connection.h
+++ b/src/settings/nm-settings-connection.h
@@ -128,12 +128,23 @@ gboolean nm_settings_connection_commit_changes (NMSettingsConnection *self,
                                                 NMSettingsConnectionCommitReason commit_reason,
                                                 GError **error);
 
+gboolean nm_settings_connection_replace_settings_prepare (NMSettingsConnection *self,
+                                                          NMConnection *new_connection,
+                                                          GError **error);
+
 gboolean nm_settings_connection_replace_settings (NMSettingsConnection *self,
                                                   NMConnection *new_connection,
                                                   gboolean update_unsaved,
                                                   const char *log_diff_name,
                                                   GError **error);
 
+gboolean nm_settings_connection_replace_settings_full (NMSettingsConnection *self,
+                                                       NMConnection *new_connection,
+                                                       gboolean prepare_new_connection,
+                                                       gboolean update_unsaved,
+                                                       const char *log_diff_name,
+                                                       GError **error);
+
 gboolean nm_settings_connection_delete (NMSettingsConnection *self,
                                         GError **error);