diff --git a/scripts/backup_to_nas.sh b/scripts/backup_to_nas.sh
new file mode 100755
index 0000000..b520d5e
--- /dev/null
+++ b/scripts/backup_to_nas.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+# Backs up plantdb volumes (SQLite db + media) to NAS via SSH.
+# Cron: 0 3 * * * /home/stephan/stacks/plantdb/scripts/backup_to_nas.sh >> /var/log/plantdb_backup.log 2>&1
+set -euo pipefail
+
+NAS_USER="stephan"
+NAS_HOST="192.168.178.110"
+NAS_PATH="/share/MD0_DATA/Public/plantdb_backup"
+SSH_KEY="/home/stephan/.ssh/plantdb_backup"
+
+docker run --rm \
+  -v plantdb_db:/data/db:ro \
+  -v plantdb_media:/data/media:ro \
+  -v "${SSH_KEY}:/root/.ssh/id_ed25519:ro" \
+  alpine sh -c "
+    apk add --no-cache rsync openssh-client -q 2>/dev/null
+    mkdir -p /root/.ssh
+    ssh-keyscan -H ${NAS_HOST} > /root/.ssh/known_hosts 2>/dev/null
+    rsync -av --delete /data/db/   ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/db/
+    rsync -av --delete /data/media/ ${NAS_USER}@${NAS_HOST}:${NAS_PATH}/media/
+  "
+
+echo "[$(date '+%Y-%m-%d %H:%M:%S')] plantdb backup complete"