diff --git a/nixos/modules/services/backup/pgbackrest.nix b/nixos/modules/services/backup/pgbackrest.nix
index 381589bc742d..6e5880ba1f90 100644
--- a/nixos/modules/services/backup/pgbackrest.nix
+++ b/nixos/modules/services/backup/pgbackrest.nix
@@ -55,6 +55,9 @@ let
   fullConfig = {
     global = normalize (cfg.settings // flattenWithIndex cfg.repos "repo");
   }
+  // lib.mapAttrs' (
+    cmd: settings: lib.nameValuePair "global:${cmd}" (normalize settings)
+  ) cfg.commands
   // lib.mapAttrs (
     _: cfg': normalize (cfg'.settings // flattenWithIndex cfg'.instances "pg")
   ) cfg.stanzas;
@@ -95,7 +98,6 @@ in
   };
 
   # TODO: Add enableServer option and corresponding pgBackRest TLS server service.
-  # TODO: Allow command-specific options
   # TODO: Write wrapper around pgbackrest to turn --repo=<name> into --repo=<number>
   # The following two are dependent on improvements upstream:
   #   https://github.com/pgbackrest/pgbackrest/issues/2621
@@ -328,6 +330,55 @@ in
         }
       '';
     };
+
+    commands =
+      lib.genAttrs
+        [
+          # List of commands from https://pgbackrest.org/command.html:
+          "annotate"
+          "archive-get"
+          "archive-push"
+          "backup"
+          "check"
+          "expire"
+          "help"
+          "info"
+          "repo-get"
+          "repo-ls"
+          "restore"
+          "server"
+          "server-ping"
+          "stanza-create"
+          "stanza-delete"
+          "stanza-upgrade"
+          "start"
+          "stop"
+          "verify"
+          "version"
+        ]
+        (
+          command:
+          lib.mkOption {
+            type = lib.types.submodule {
+              freeformType = settingsType;
+
+              # The following options are not fully supported / tested, yet, but point to files with secrets.
+              # Users can already set those options, but we'll force non-store paths.
+              options.tls-server-cert-file = secretPathOption;
+              options.tls-server-key-file = secretPathOption;
+            };
+            default = { };
+            description = ''
+              Options for the '${command}' command.
+
+              An attribute set of options as described in:
+              <https://pgbackrest.org/configuration.html>
+
+              All globally available options, i.e. all except stanza options, can be used.
+              Repository options should be set via [`repos`](#opt-services.pgbackrest.repos) instead.
+            '';
+          }
+        );
   };
 
   config = lib.mkIf cfg.enable (
@@ -408,6 +459,9 @@ in
             user = "postgres";
           };
         };
+        # If PostgreSQL runs on the same machine, any restore will have to be done with that user.
+        # Keeping the lock file in a directory writeable by the postgres user prevents errors.
+        services.pgbackrest.commands.restore.lock-path = "/tmp/postgresql";
         services.postgresql.identMap = ''
           postgres pgbackrest postgres
         '';
diff --git a/pkgs/by-name/pg/pgbackrest/package.nix b/pkgs/by-name/pg/pgbackrest/package.nix
index 9128586315b5..122516cbefbd 100644
--- a/pkgs/by-name/pg/pgbackrest/package.nix
+++ b/pkgs/by-name/pg/pgbackrest/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pgbackrest";
-  version = "2.55.1";
+  version = "2.56.0";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
     tag = "release/${finalAttrs.version}";
-    hash = "sha256-A1dTywcCHBu7Ml0Q9k//VVPFN1C3kmmMkq4ok9T4g94=";
+    hash = "sha256-GDHpeTz85cgKTbcuaTlwJ1SUNMedSylqKWdrgH8Zp8Q=";
   };
 
   strictDeps = true;