diff --git a/hosts/ds9/default.nix b/hosts/ds9/default.nix
index 4f4ab21c..3baade31 100644
--- a/hosts/ds9/default.nix
+++ b/hosts/ds9/default.nix
@@ -51,11 +51,19 @@ in
 
   };
 
+  services.openssh.sftpServerExecutable = "internal-sftp";
+  services.openssh.extraConfig = ''
+    Match User picardbackup
+      ChrootDirectory ${config.users.users.picardbackup.home}
+      ForceCommand internal-sftp
+      AllowTcpForwarding no
+  '';
+
   # Backup Target
   users.users.picardbackup = {
     createHome = true;
     group = "users";
-    home = "/backups/picard";
+    home = "/backups/restic/picard";
     isSystemUser = true;
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHvCF8KGgpF9O8Q7k+JXqZ5eMeEeTaMhCIk/2ZFOzXL0"
diff --git a/hosts/picard/default.nix b/hosts/picard/default.nix
index 936ece5a..a2adeeef 100644
--- a/hosts/picard/default.nix
+++ b/hosts/picard/default.nix
@@ -56,7 +56,7 @@
       "--keep-yearly 75"
     ];
     initialize = true;
-    repository = "sftp:ds9:/backups/picard/restic";
+    repository = "sftp:picardbackup@ds9:/restic";
     paths = [
       "/persistent"
     ];
diff --git a/nixos-modules/system/security.nix b/nixos-modules/system/security.nix
index e3f56e89..53fc4c49 100644
--- a/nixos-modules/system/security.nix
+++ b/nixos-modules/system/security.nix
@@ -12,7 +12,7 @@ in
     security.sudo.execWheelOnly = true;
     services.openssh = {
       passwordAuthentication = false;
-      allowSFTP = false; # just use rsync, lol
+      allowSFTP = true; # just use rsync, lol
       kbdInteractiveAuthentication = false;
       extraConfig = ''
         AllowTcpForwarding yes