diff --git a/flake.lock b/flake.lock
index a29d6bc..4932760 100644
--- a/flake.lock
+++ b/flake.lock
@@ -447,11 +447,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729124250,
-        "narHash": "sha256-k8aMgyuqVsZk6MYSRJXSyYqaLURnvkFDHsFBRRIDtuU=",
+        "lastModified": 1729473256,
+        "narHash": "sha256-gfJWzvQDWuZKRcOIv2gUwLqGoM48J2qmHur4c6MpQyU=",
         "owner": "appaquet",
         "repo": "dotfiles-secrets",
-        "rev": "d847a4f62505cb70a397267d8f932b2b17ad7a67",
+        "rev": "60d3e2ca6c6d4e9b448dc7942d62580c926d44cc",
         "type": "github"
       },
       "original": {
diff --git a/nixos/deskapp/home-backup.nix b/nixos/deskapp/home-backup.nix
index d52e5c7..d062b71 100644
--- a/nixos/deskapp/home-backup.nix
+++ b/nixos/deskapp/home-backup.nix
@@ -1,4 +1,4 @@
-{ pkgs, secrets, config, ... }:
+{ pkgs, config, ... }:
 
 let
   exclude = [
@@ -31,13 +31,15 @@ let
   ];
   foldersStr = builtins.concatStringsSep " " (map (x: "${homePath}/" + x) folders);
 
-  backupMount = "/mnt/deskapp_backup";
+  sshCmd = "${pkgs.openssh}/bin/ssh";
+  nasHost = "192.168.0.20";
+  nasDest = "/volume1/backup_deskapp/home/";
   backupScript = pkgs.writeShellScriptBin "backup-home" ''
     set -x
 
     for FOLDER in ${foldersStr}; do
       echo "Syncing $FOLDER"
-      ${pkgs.rsync}/bin/rsync -av --progress ${excludeStr} --delete --delete-excluded $FOLDER ${backupMount}/home/ || true
+      ${pkgs.rsync}/bin/rsync -av --progress ${excludeStr} --delete -e ${sshCmd} --delete-excluded $FOLDER ${nasHost}:${nasDest} || true
     done
   '';
 in
@@ -47,29 +49,6 @@ in
     pkgs.cifs-utils
   ];
 
-  fileSystems."${backupMount}" = {
-    device = "//192.168.0.20/backup_deskapp";
-    fsType = "cifs";
-    options =
-      let
-        automount_opts_list = [
-          "vers=3.0"
-          "uid=appaquet"
-          "gid=users"
-          # don't mount with fstab, but with systemd & make it resilient to network failures
-          # from https://discourse.nixos.org/t/seeking-help-with-mounting-samba-cifs-behind-a-vpn-currently-using-autofs/35436/6
-          "noauto"
-          "x-systemd.automount"
-          "x-systemd.idle-timeout=60"
-          "x-systemd.device-timeout=5s"
-          "x-systemd.mount-timeout=5s"
-          "credentials=${secrets.deskapp.nasappCifs}"
-        ];
-        automount_opts = builtins.concatStringsSep "," automount_opts_list;
-      in
-      [ automount_opts ];
-  };
-
   systemd.services."backup-home" = {
     serviceConfig = {
       Type = "oneshot";
diff --git a/nixos/deskapp/vms-backup.nix b/nixos/deskapp/vms-backup.nix
index 65dff70..25f0bec 100644
--- a/nixos/deskapp/vms-backup.nix
+++ b/nixos/deskapp/vms-backup.nix
@@ -1,9 +1,11 @@
-{ pkgs, secrets, ... }:
+{ pkgs, ... }:
 
 let
-  backupMount = "/mnt/deskapp_backup_vms";
   vmsDir = "/mnt/secondary/vms";
 
+  sshCmd = "${pkgs.openssh}/bin/ssh";
+  nasHost = "192.168.0.20";
+  nasDest = "/volume1/backup_deskapp_vms/";
   backupScript = pkgs.writeShellScriptBin "backup-vms" ''
     set -xe
 
@@ -32,7 +34,7 @@ let
     chmod -R u+wr,g+wr,a+r .
 
     # Backup
-    ${pkgs.rsync}/bin/rsync -av --progress --delete --whole-file --sparse . ${backupMount}/
+    ${pkgs.rsync}/bin/rsync -av --progress --delete --whole-file -e ${sshCmd} --sparse . ${nasHost}:${nasDest}
   '';
 in
 
@@ -41,29 +43,6 @@ in
     pkgs.cifs-utils
   ];
 
-  fileSystems."${backupMount}" = {
-    device = "//192.168.0.20/backup_deskapp_vms";
-    fsType = "cifs";
-    options =
-      let
-        automount_opts_list = [
-          "vers=3.0"
-          "uid=appaquet"
-          "gid=users"
-          # don't mount with fstab, but with systemd & make it resilient to network failures
-          # from https://discourse.nixos.org/t/seeking-help-with-mounting-samba-cifs-behind-a-vpn-currently-using-autofs/35436/6
-          "noauto"
-          "x-systemd.automount"
-          "x-systemd.idle-timeout=60"
-          "x-systemd.device-timeout=5s"
-          "x-systemd.mount-timeout=5s"
-          "credentials=${secrets.deskapp.nasappCifs}"
-        ];
-        automount_opts = builtins.concatStringsSep "," automount_opts_list;
-      in
-      [ automount_opts ];
-  };
-
   systemd.services."backup-vms" = {
     serviceConfig = {
       Type = "oneshot";
diff --git a/secrets b/secrets
index d847a4f..60d3e2c 160000
--- a/secrets
+++ b/secrets
@@ -1 +1 @@
-Subproject commit d847a4f62505cb70a397267d8f932b2b17ad7a67
+Subproject commit 60d3e2ca6c6d4e9b448dc7942d62580c926d44cc