diff --git a/inc/auth.php b/inc/auth.php
index 1d325b02ce52f45c45d70bda97680e073f38925b..aa5439a0d4c0b69e44bafe3f18c12a6f6b321fb2 100644
--- a/inc/auth.php
+++ b/inc/auth.php
@@ -84,7 +84,8 @@
     if(is_readable(DOKU_CONF.'acl.auth.php')){
       $AUTH_ACL = file(DOKU_CONF.'acl.auth.php');
       if(isset($_SERVER['REMOTE_USER'])){
-        $AUTH_ACL = str_replace('@USER@',$_SERVER['REMOTE_USER'],$AUTH_ACL);
+        $AUTH_ACL = str_replace('%USER%',$_SERVER['REMOTE_USER'],$AUTH_ACL);
+        $AUTH_ACL = str_replace('@USER@',$_SERVER['REMOTE_USER'],$AUTH_ACL); //legacy
       }
     }else{
       $AUTH_ACL = array();
diff --git a/lib/plugins/acl/admin.php b/lib/plugins/acl/admin.php
index 6301f1739f70774176c255a34ccc832455e230c9..35b14d32822b957107ac6b85671b0737215f3806 100644
--- a/lib/plugins/acl/admin.php
+++ b/lib/plugins/acl/admin.php
@@ -63,6 +63,9 @@ class admin_plugin_acl extends DokuWiki_Admin_Plugin {
         global $AUTH_ACL;
         global $ID;
 
+        // fresh 1:1 copy without replacements
+        $AUTH_ACL = file(DOKU_CONF.'acl.auth.php');
+
         // namespace given?
         if($_REQUEST['ns'] == '*'){
             $this->ns = '*';