diff --git a/nodes/htz-cloud/miniserver.py b/nodes/htz-cloud/miniserver.py
index 6a14dc5..74f6f25 100644
--- a/nodes/htz-cloud/miniserver.py
+++ b/nodes/htz-cloud/miniserver.py
@@ -1,5 +1,4 @@
 # sophie's miniserver
-# mostly unmanaged
 
 nodes['htz-cloud.miniserver'] = {
     'bundles': {
@@ -52,6 +51,7 @@ nodes['htz-cloud.miniserver'] = {
                     'echo \'core.weechat */layout store\' >> /home/sophie/.weechat/weechat_fifo\n' \
                     'echo \'core.weechat */save\' >> /home/sophie/.weechat/weechat_fifo\n',
             },
+            'target': "htz-hel.backup-sophie",
         },
         'backups': {
             'paths': {
diff --git a/nodes/htz-hel/backup-sophie.py b/nodes/htz-hel/backup-sophie.py
index fb3198b..0d74b67 100644
--- a/nodes/htz-hel/backup-sophie.py
+++ b/nodes/htz-hel/backup-sophie.py
@@ -1,6 +1,7 @@
 nodes['htz-hel.backup-sophie'] = {
     'hostname': 'backup.sophies-kitchen.eu',
     'bundles': {
+        'backup-server',
         'zfs',
     },
     'groups': {
@@ -11,6 +12,11 @@ nodes['htz-hel.backup-sophie'] = {
             'packages': {
                 'borgbackup': {},
             },
+            'unattended-upgrades': {
+                # requires manual apply after reboot to unlock dm-crypt
+                # devices
+                'reboot-enabled': False,
+            },
         },
         'backups': {
             'exclude_from_backups': True,
@@ -30,11 +36,15 @@ nodes['htz-hel.backup-sophie'] = {
             'cpu': 4,
             'ram': 8,
         },
+        'backup-server': {
+            'zfs-base': 'tank/backups',
+        },
         'zfs': {
             'datasets': {
                 'tank/ejgwthink': {
                     'mountpoint': '/mnt/backups/ejgwthink',
                 },
+                'tank/backups': {},
             },
             'pools': {
                 'tank': {