diff --git a/machines/storage01/forgejo.nix b/machines/storage01/forgejo.nix
index a3c2ef1..9092f65 100644
--- a/machines/storage01/forgejo.nix
+++ b/machines/storage01/forgejo.nix
@@ -87,4 +87,12 @@ in
   age-secrets.matches."^forgejo-.*$" = {
     owner = "git";
   };
+
+  dgn-backups.jobs.forgejo.settings.paths = builtins.map (dir: "/var/lib/git/${dir}") [
+    "custom"
+    "data"
+    "repositories"
+    ".ssh"
+  ];
+  dgn-backups.postgresDatabases = [ "git" ];
 }
diff --git a/machines/storage01/netbird/default.nix b/machines/storage01/netbird/default.nix
index 7291c67..178d4ef 100644
--- a/machines/storage01/netbird/default.nix
+++ b/machines/storage01/netbird/default.nix
@@ -43,5 +43,5 @@ in
     };
   };
 
-  # age-secrets.autoMatch = [ "netbird" ];
+  dgn-backups.jobs.netbird.settings.paths = [ "/var/lib/netbird-mgmt" ];
 }
diff --git a/machines/storage01/secrets/bupstash-put_key b/machines/storage01/secrets/bupstash-put_key
new file mode 100644
index 0000000..bb8369a
Binary files /dev/null and b/machines/storage01/secrets/bupstash-put_key differ
diff --git a/machines/storage01/secrets/secrets.nix b/machines/storage01/secrets/secrets.nix
index 52bbbbc..50b743a 100644
--- a/machines/storage01/secrets/secrets.nix
+++ b/machines/storage01/secrets/secrets.nix
@@ -4,6 +4,7 @@ let
 in
 lib.setDefault { inherit publicKeys; } [
   "atticd-credentials_file"
+  "bupstash-put_key"
   "forgejo-mailer_password_file"
   "forgejo_runners-token_file"
   "garage-environment_file"