diff --git a/nixos/modules/services/backup/btrbk.nix b/nixos/modules/services/backup/btrbk.nix
index c44fc48836ce..3ee21ecebe7e 100644
--- a/nixos/modules/services/backup/btrbk.nix
+++ b/nixos/modules/services/backup/btrbk.nix
@@ -10,6 +10,7 @@ let
     concatMap
     concatMapStringsSep
     concatStringsSep
+    escapeShellArgs
     filterAttrs
     getAttr
     isAttrs
@@ -275,6 +276,15 @@ in
                 ];
                 description = "What actions can be performed with this SSH key. See ssh_filter_btrbk(1) for details";
               };
+              extraArgs = mkOption {
+                type = listOf str;
+                description = "Additional arguments to pass to ssh_filter_btrbk";
+                default = [ ];
+                example = [
+                  "--log"
+                  "--restrict-path <path>"
+                ];
+              };
             };
           });
         default = [ ];
@@ -335,7 +345,7 @@ in
         in
         ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${
           optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"
-        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
+        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options} ${escapeShellArgs v.extraArgs}" ${v.key}''
       ) cfg.sshAccess;
     };
     users.groups.btrbk = { };