As industrial control systems become increasingly connected, the threat of cyberattacks grows in turn. Classical IT reactions that prioritize confidentiality, like network isolation, cannot be applied as they lead to a loss of availability, hence an issue of safety criticality. This work proposes a reconfiguration-based reaction to attacks, migrating control programs away from compromised components. This reconfiguration is carried out by a controller which solves a constraint programming (CP) problem whenever a compromised device is detected. This controller is automatically generated based on a model of IEC 62443 compliant systems. This approach is tested both on generated models of arbitrary size and to control a set of real Programmable Logic Controller (PLC) overseeing a small-scale training factory.