diff --git a/nixos/modules/services/backup/restic.nix b/nixos/modules/services/backup/restic.nix
index f4bcca395813..333fdd494e3b 100644
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@@ -206,6 +206,22 @@ in
           '';
           example = "find /home/matt/git -type d -name .git";
         };
+
+        backupPrepareCommand = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = ''
+            A script that must run before starting the backup process.
+          '';
+        };
+
+        backupCleanupCommand = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = ''
+            A script that must run after finishing the backup process.
+          '';
+        };
       };
     }));
     default = { };
@@ -283,8 +299,11 @@ in
             } // optionalAttrs (backup.environmentFile != null) {
               EnvironmentFile = backup.environmentFile;
             };
-          } // optionalAttrs (backup.initialize || backup.dynamicFilesFrom != null) {
+          } // optionalAttrs (backup.initialize || backup.dynamicFilesFrom != null || backup.backupPrepareCommand != null) {
             preStart = ''
+              ${optionalString (backup.backupPrepareCommand != null) ''
+                ${pkgs.writeScript "backupPrepareCommand" backup.backupPrepareCommand}
+              ''}
               ${optionalString (backup.initialize) ''
                 ${resticCmd} snapshots || ${resticCmd} init
               ''}
@@ -292,9 +311,14 @@ in
                 ${pkgs.writeScript "dynamicFilesFromScript" backup.dynamicFilesFrom} > ${filesFromTmpFile}
               ''}
             '';
-          } // optionalAttrs (backup.dynamicFilesFrom != null) {
+          } // optionalAttrs (backup.dynamicFilesFrom != null || backup.backupCleanupCommand != null) {
             postStart = ''
-              rm ${filesFromTmpFile}
+              ${optionalString (backup.backupCleanupCommand != null) ''
+                ${pkgs.writeScript "backupCleanupCommand" backup.backupCleanupCommand}
+              ''}
+              ${optionalString (backup.dynamicFilesFrom != null) ''
+                rm ${filesFromTmpFile}
+              ''}
             '';
           })
         )
diff --git a/nixos/tests/restic.nix b/nixos/tests/restic.nix
index 16d7edde0c1c..7523d5e5ed5d 100644
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@@ -7,6 +7,16 @@ import ./make-test-python.nix (
     repositoryFile = "${pkgs.writeText "repositoryFile" "/tmp/restic-backup-from-file"}";
     rcloneRepository = "rclone:local:/tmp/restic-rclone-backup";
 
+    backupPrepareCommand = ''
+      touch /opt/backupPrepareCommand
+      test ! -e /opt/backupCleanupCommand
+    '';
+
+    backupCleanupCommand = ''
+      rm /opt/backupPrepareCommand
+      touch /opt/backupCleanupCommand
+    '';
+
     passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
     initialize = true;
     paths = [ "/opt" ];
@@ -30,7 +40,7 @@ import ./make-test-python.nix (
         {
           services.restic.backups = {
             remotebackup = {
-              inherit repository passwordFile initialize paths pruneOpts;
+              inherit repository passwordFile initialize paths pruneOpts backupPrepareCommand backupCleanupCommand;
             };
             remotebackup-from-file = {
               inherit repositoryFile passwordFile initialize paths pruneOpts;
@@ -73,6 +83,7 @@ import ./make-test-python.nix (
           "mkdir -p /tmp/restic-rclone-backup",
           "timedatectl set-time '2016-12-13 13:45'",
           "systemctl start restic-backups-remotebackup.service",
+          "rm /opt/backupCleanupCommand",
           "systemctl start restic-backups-remotebackup-from-file.service",
           "systemctl start restic-backups-rclonebackup.service",
           '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
@@ -80,18 +91,23 @@ import ./make-test-python.nix (
           '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
           "timedatectl set-time '2017-12-13 13:45'",
           "systemctl start restic-backups-remotebackup.service",
+          "rm /opt/backupCleanupCommand",
           "systemctl start restic-backups-rclonebackup.service",
           "timedatectl set-time '2018-12-13 13:45'",
           "systemctl start restic-backups-remotebackup.service",
+          "rm /opt/backupCleanupCommand",
           "systemctl start restic-backups-rclonebackup.service",
           "timedatectl set-time '2018-12-14 13:45'",
           "systemctl start restic-backups-remotebackup.service",
+          "rm /opt/backupCleanupCommand",
           "systemctl start restic-backups-rclonebackup.service",
           "timedatectl set-time '2018-12-15 13:45'",
           "systemctl start restic-backups-remotebackup.service",
+          "rm /opt/backupCleanupCommand",
           "systemctl start restic-backups-rclonebackup.service",
           "timedatectl set-time '2018-12-16 13:45'",
           "systemctl start restic-backups-remotebackup.service",
+          "rm /opt/backupCleanupCommand",
           "systemctl start restic-backups-rclonebackup.service",
           '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',
           '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',