diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index 07850f7..dd23c61 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -5,6 +5,16 @@
   ...
 }: let
   cfg = config.aa.services.nextcloud;
+  secrets = config.age.secrets;
+
+  mkNextcloudSecret = attrs: {
+    name = attrs.name;
+    value = {
+      file = attrs.path;
+      owner = "nextcloud";
+      group = "nextcloud";
+    };
+  };
 in {
   options.aa.services.nextcloud = with lib; {
     enable = mkEnableOption "nextcloud";
@@ -19,11 +29,24 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    age.secrets.nextcloud_admin = {
-      file = ../../../../secrets/nextcloud_admin.age;
-      owner = "nextcloud";
-      group = "nextcloud";
-    };
+    age.secrets = builtins.listToAttrs (builtins.map (attrs: mkNextcloudSecret attrs) [
+      {
+        name = "restic/password";
+        path = ../../../../secrets/nextcloud_restic_password.age;
+      }
+      {
+        name = "restic/env";
+        path = ../../../../secrets/nextcloud_restic_env.age;
+      }
+      {
+        name = "restic/repo";
+        path = ../../../../secrets/nextcloud_restic_repo.age;
+      }
+      {
+        name = "nextcloud_admin";
+        path = ../../../../secrets/nextcloud_admin.age;
+      }
+    ]);
 
     services.nextcloud = {
       enable = true;
@@ -47,7 +70,7 @@ in {
       config = {
         dbtype = "pgsql";
         adminuser = "alejandro";
-        adminpassFile = config.age.secrets.nextcloud_admin.path;
+        adminpassFile = secrets.nextcloud_admin.path;
       };
     };
 
@@ -57,6 +80,23 @@ in {
       useACMEHost = cfg.acmeCertName;
     };
 
+    services.restic.backups = {
+      nextcloud = {
+        user = "nextcloud";
+        initialize = true;
+        paths = [config.services.nextcloud.datadir];
+        environmentFile = secrets."restic/env".path;
+        repositoryFile = secrets."restic/repo".path;
+        passwordFile = secrets."restic/password".path;
+        timerConfig = {
+          OnCalendar = "00:05";
+          Persistent = true;
+          RandomizedDelaySec = "5h";
+        };
+        pruneOpts = ["--keep-daily 7" "--keep-weekly 5" "--keep-monthly 12" "--keep-yearly 9001"];
+      };
+    };
+
     networking.firewall.allowedTCPPorts = [80 443];
   };
 }
diff --git a/secrets/nextcloud_restic_env.age b/secrets/nextcloud_restic_env.age
new file mode 100644
index 0000000..e19d4e9
Binary files /dev/null and b/secrets/nextcloud_restic_env.age differ
diff --git a/secrets/nextcloud_restic_password.age b/secrets/nextcloud_restic_password.age
new file mode 100644
index 0000000..8c46824
--- /dev/null
+++ b/secrets/nextcloud_restic_password.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> piv-p256 UIEGzg AtUSDrnOeV44xXzVmduHJgpJEzozc+LqdLKlkiiDdJXA
+cJWbnIZGvISxhNXa6Jpiw8NrEfCncMAQHfW8v5uzzvE
+-> ssh-ed25519 Yk7ehg OwDJrMxpMvaxDnGBaSr8+WjGy44DAYwcPo7qujD8zCQ
+7LjtdWBG9+n89+NWvWLX/E63se9okelHkEb2HxFAkU8
+--- 7f/WYFPS9vxFsRa6MNX6EAbGya42EsVxrZbCTEhuIOc
+P��O�<c��[&�!W*o�gJo�,�� P��@�ؔ���7��	��%��"rʽ�=�c�k�c�#�P�@���lƗ��Xi"�
�c庀G���m�N��/�j�W�j�ku:�x��(�.�>%�ߑ#~͞�v���/kb��F�g3���Q���
\ No newline at end of file
diff --git a/secrets/nextcloud_restic_repo.age b/secrets/nextcloud_restic_repo.age
new file mode 100644
index 0000000..875f289
--- /dev/null
+++ b/secrets/nextcloud_restic_repo.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> piv-p256 UIEGzg AowX1qo/8GwbPcZGt2yW77S7rA8/xtDGUocmR3hmQpTO
+vNy0dR5fwAk+2fV7xhEQq9Ja4VRW5RaDHo9a3L1FZhk
+-> ssh-ed25519 Yk7ehg IUjXb3+yVVIY3aa5wTagrRdm3bL9fGfCCfc20roqh1g
+D+aX+TYMg21CCfpVj6DQVcaRbU4sN5tB0aC0R6TfBFw
+--- u2cH5LG8E5DBRkL8FGq3s1I2Ht5Lhlk9hKrSaOjtISQ
+=q(�=v�c��~i�(Pa�G��G��x!	�I��<&��N��7�JA.�'e
+DH�Lt�t	1J�F�L�(9�Ek[��Q�����;ł?�/ʤnP��
\ No newline at end of file
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 4d53ec0..e63a709 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -15,6 +15,9 @@ in {
   "hass_mqtt.age".publicKeys = [users.me machines.pi4 machines.node machines.gospel];
   "hydra-aws-creds.age".publicKeys = [users.me machines.gospel];
   "nextcloud_admin.age".publicKeys = [users.me machines.node machines.gospel];
+  "nextcloud_restic_env.age".publicKeys = [users.me machines.node];
+  "nextcloud_restic_password.age".publicKeys = [users.me machines.node];
+  "nextcloud_restic_repo.age".publicKeys = [users.me machines.node];
   "tailscale_git_server.age".publicKeys = [users.me machines.git]; # This key expires, might have to update
   "teslamate_db.age".publicKeys = [users.me machines.node machines.gospel];
   "teslamate_encryption.age".publicKeys = [users.me machines.node machines.gospel];