diff --git a/restic-backup/.local/bin/restic-backup b/restic-backup/.local/bin/restic-backup
new file mode 100755
index 0000000..7bb5577
--- /dev/null
+++ b/restic-backup/.local/bin/restic-backup
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+set -e
+
+source ~/.config/restic-backup/config.sh
+
+cleanup() {
+  pass gocrypt close || true > /dev/null 2>&1
+}
+
+trap cleanup EXIT
+
+pass gocrypt close > /dev/null 2>&1 || true
+PASS_GOCRYPT_CLOSE_TIMEOUT=2147483648 pass gocrypt open
+
+for dir in ${RESTIC_BACKUP_SUBVOL_PATHS[@]}; do 
+  parent="$(dirname $dir)"
+  snap="$parent/$(basename $dir)-restic"
+  echo "snap = $snap"
+  sudo btrfs subvol delete "$snap" > /dev/null 2>&1 || true
+  sudo btrfs subvol snap "$dir" "$snap"
+  restic-wrapper --verbose backup "$snap"
+  sudo btrfs subvol delete "$snap" || true
+done
diff --git a/restic-backup/.local/bin/restic-wrapper b/restic-backup/.local/bin/restic-wrapper
new file mode 100755
index 0000000..84adee2
--- /dev/null
+++ b/restic-backup/.local/bin/restic-wrapper
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -e
+
+source ~/.config/restic-backup/config.sh
+pass gocrypt open || true
+sudo restic --password-file /dev/stdin -r "$RESTIC_BACKUP_REPO" $@ <<< $(pass show "$RESTIC_BACKUP_PASS")