diff --git a/CRM/Twingle/Profile.php b/CRM/Twingle/Profile.php
index 0be09b9..fafe07e 100644
--- a/CRM/Twingle/Profile.php
+++ b/CRM/Twingle/Profile.php
@@ -152,7 +152,7 @@ class CRM_Twingle_Profile {
    * @return string CiviCRM transaction ID
    */
   public function getTransactionID($twingle_id) {
-    $prefix = CRM_Core_BAO_Setting::getItem('de.systopia.twingle', 'twingle_prefix');
+    $prefix = Civi::settings()->get('twingle_prefix');
     if (empty($prefix)) {
       return $twingle_id;
     } else {
@@ -338,7 +338,7 @@ class CRM_Twingle_Profile {
   public static function getProfiles() {
     if (self::$_profiles === NULL) {
       self::$_profiles = array();
-      if ($profiles_data = CRM_Core_BAO_Setting::getItem('de.systopia.twingle', 'twingle_profiles')) {
+      if ($profiles_data = Civi::settings()->get('twingle_profiles')) {
         foreach ($profiles_data as $profile_name => $profile_data) {
           self::$_profiles[$profile_name] = new CRM_Twingle_Profile($profile_name, $profile_data);
         }
@@ -363,6 +363,6 @@ class CRM_Twingle_Profile {
     foreach (self::$_profiles as $profile_name => $profile) {
       $profile_data[$profile_name] = $profile->data;
     }
-    CRM_Core_BAO_Setting::setItem((object) $profile_data, 'de.systopia.twingle', 'twingle_profiles');
+    Civi::settings()->set('twingle_profiles', $profile_data);
   }
 }
diff --git a/CRM/Twingle/Submission.php b/CRM/Twingle/Submission.php
index b6ca4a5..50c7204 100644
--- a/CRM/Twingle/Submission.php
+++ b/CRM/Twingle/Submission.php
@@ -269,10 +269,7 @@ class CRM_Twingle_Submission {
       'is_active' => 1,
     ));
     return
-      CRM_Core_BAO_Setting::getItem(
-        'de.systopia.twingle',
-        'twingle_use_sepa'
-      )
+      Civi::settings()->get('twingle_use_sepa')
       && $sepa_extension['count'];
   }
 
diff --git a/CRM/Twingle/Tools.php b/CRM/Twingle/Tools.php
index 08a596f..a6a437f 100644
--- a/CRM/Twingle/Tools.php
+++ b/CRM/Twingle/Tools.php
@@ -42,11 +42,11 @@ class CRM_Twingle_Tools {
     if (self::$protection_suspended) return;
 
     // currently only works with prefixes
-    $prefix = CRM_Core_BAO_Setting::getItem('de.systopia.twingle', 'twingle_prefix');
+    $prefix = Civi::settings()->get('twingle_prefix');
     if (empty($prefix)) return;
 
     // check if protection is turned on
-    $protection_on = CRM_Core_BAO_Setting::getItem('de.systopia.twingle', 'twingle_protect_recurring');
+    $protection_on = Civi::settings()->get('twingle_protect_recurring');
     if (empty($protection_on)) return;
 
     // load the recurring contribution
diff --git a/CRM/Twingle/Upgrader.php b/CRM/Twingle/Upgrader.php
index ec78674..35c1283 100644
--- a/CRM/Twingle/Upgrader.php
+++ b/CRM/Twingle/Upgrader.php
@@ -143,4 +143,24 @@ class CRM_Twingle_Upgrader extends CRM_Twingle_Upgrader_Base {
     return TRUE;
   }
 
+  /**
+   * Convert serialized settings from objects to arrays.
+   *
+   * @link https://civicrm.org/advisory/civi-sa-2019-21-poi-saved-search-and-report-instance-apis
+   */
+  public function upgrade_5011() {
+    // Do not use CRM_Core_BAO::getItem() or Civi::settings()->get().
+    // Extract and unserialize directly from the database.
+    $twingle_profiles_query = CRM_Core_DAO::executeQuery("
+        SELECT `value`
+          FROM `civicrm_setting`
+        WHERE `name` = 'twingle_profiles';");
+    if ($twingle_profiles_query->fetch()) {
+      $profiles = unserialize($twingle_profiles_query->value);
+      Civi::settings()->set('twingle_profiles', (array) $profiles);
+    }
+
+    return TRUE;
+  }
+
 }