diff --git a/flake.nix b/flake.nix
index c5365fb..09f40d3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -228,7 +228,7 @@
         }
         # ssh keys
         (
-          { config, ... }:
+          { config, pkgs, ... }:
           {
             users.users.root.openssh.authorizedKeys.keyFiles = [
               # master key
@@ -238,6 +238,7 @@
               "${config.clan.core.clanDir}/machines/chungus/facts/ssh.rbackup.id_ed25519.pub"
               "${config.clan.core.clanDir}/machines/chungus/facts/ssh.paperless-ngx.id_ed25519.pub"
             ];
+            environment.systemPackages = [ pkgs.borgbackup ];
           }
         )
         {
diff --git a/machines/chungus/service-paperless.nix b/machines/chungus/service-paperless.nix
index 491cb6c..0ba4f5c 100644
--- a/machines/chungus/service-paperless.nix
+++ b/machines/chungus/service-paperless.nix
@@ -58,11 +58,11 @@
   # backup
   services.borgbackup.jobs."paperless-ngx" = {
     paths = [ config.services.paperless.dataDir ];
-    repo = "root@orbi.bear:${config.networking.hostName}/paperless-borg-backup";
+    repo = "root@orbi.bear:borg-${config.networking.hostName}-paperless";
     compression = "auto,lzma";
     startAt = "daily";
     encryption = {
-      mode = "repokey-blake2";
+      mode = "keyfile-blake2";
       passCommand = "cat ${
         toString config.clan.core.facts.services."paperless-ngx.borg".secret."password.borgbackup".path
       }";