diff --git a/.local/bin/scripts/bag b/.local/bin/scripts/bag
index 3fee959..6660762 100755
--- a/.local/bin/scripts/bag
+++ b/.local/bin/scripts/bag
@@ -14,8 +14,8 @@ done
 test $# -gt 0 || cd "$root"
 name="::$(test -n "$name" && echo "$name" || cat /etc/hostname)_${1:-system}_$(date -u +"%y%m%d")"
 echo "Backing up as $name"
-${run:-sudo --preserve-env=BORG_REPO borg} create --exclude-caches $args \
-  $(echo $DIRS_IGNORE_SAFE -x 'software-challenge/**/build' -x state/emacs -x state/go -x .local/lib -x .cpan |
+${run:-sudo --preserve-env=BORG_REPO BORG_PASSPHRASE="$($BORG_PASSCOMMAND)" borg} create --exclude-caches $args \
+  $(echo $DIRS_IGNORE_SAFE -x 'software-challenge/**/build' -x state/emacs -x state/go -x .local/lib -x .cpan -x *cache |
     sed 's|-x \([^ ]\+\)|-e sh:**/\1|g') \
   "$name" $(test $# -eq 0 && echo etc home root || test $# -eq 1 && echo $1) "${@:2}"  2>&1
 sudo chown -R $USER:$USER "$BORG_REPO"
diff --git a/.zshenv b/.zshenv
index 56a5727..cf7167c 100644
--- a/.zshenv
+++ b/.zshenv
@@ -2,7 +2,7 @@ export DATA="$(test -d $HOME/daten && echo $HOME/daten || echo $HOME/data)"
 export MUSIC="$DATA/music"
 
 export BORG_REPO="/mnt/backup/borg"
-export BORG_PASSCOMMAND='pass services/borg/backup'
+export BORG_PASSCOMMAND='pass service/devices/borg/backup'
 
 # xdg
 export XDG_DATA_HOME="$HOME/.local/share"
@@ -68,8 +68,8 @@ which nvim >/dev/null && export EDITOR='nvim' || export EDITOR='vim'
 export LESS="--RAW-CONTROL-CHARS --ignore-case --LONG-PROMPT --jump-target=5 $(test $(less --version | head -1 | cut -f2 -d' ') -ge 590 && echo --incsearch)"
  # TODO put into config file and use --exclude-from
 export DIRS_GENERATED="-x generated -x .gradle -x cmake_build -x dist-newstyle -x node_modules -x __pycache__"
-export DIRS_IGNORE_SAFE="-x .sync -x .stfolder -x .cache -x *Cache -x .pyenv -x .local/cache -x share/baloo -x share/cabal -x share/cargo -x share/digikam -x share/JetBrains -x share/tldr -x share/syncthing -x share/Steam/ubuntu* -x share/virtualenv -x share/Zeal -x state/gradle -x state/android -x Ferdi/Partitions -x oh-my-zsh $DIRS_GENERATED"
-export DIRS_IGNORE="-x *build -x .git -x .idea -x out -x cache -x Partitions $DIRS_IGNORE_SAFE"
+export DIRS_IGNORE_SAFE="-x .sync -x .stfolder -x .cache -x .cpan -x *Cache -x .pyenv -x .local/cache -x share/baloo -x share/cabal -x share/cargo -x share/digikam -x share/JetBrains -x share/tldr -x share/syncthing -x share/Steam/ubuntu* -x share/Steam/package -x share/virtualenv -x share/Zeal -x state/gradle -x state/android -x Ferdi/Partitions -x oh-my-zsh -x wine/drive_c/windows $DIRS_GENERATED"
+export DIRS_IGNORE="-x *build -x .git -x .idea -x out -x *cache -x Partitions $DIRS_IGNORE_SAFE"
 # red stderr
 test -f "/usr/lib/libstderred.so" && export LD_PRELOAD="/usr/lib/libstderred.so${LD_PRELOAD:+:$LD_PRELOAD}"
 # software config