diff --git a/src/libeis-client.c b/src/libeis-client.c
index 3ee396f..21d263e 100644
--- a/src/libeis-client.c
+++ b/src/libeis-client.c
@@ -473,7 +473,8 @@ client_msg_configure_capabilities(struct eis_client *client, uint32_t allowed_ca
 	if (client->state != EIS_CLIENT_STATE_NEW)
 		return 0;
 
-	client->restrictions.cap_allow_mask = allowed_caps;
+	/* restrictions can only be reduced */
+	client->restrictions.cap_allow_mask &= allowed_caps;
 
 	return 0;
 }