you extract and overwrite (this is why it's important to keep your web.config safe, as you'll need to rename the release.config in the new zip as web.config, and then cut-and-paste the key values [machinevalidationkey, machineencryptionkey and connectionstrin] into the renamed release.config from your 'old' web.config)
Cathal