diff --git a/flake.lock b/flake.lock
index 83ccfd7..bc23e36 100644
--- a/flake.lock
+++ b/flake.lock
@@ -150,6 +150,22 @@
         "type": "github"
       }
     },
+    "impermanence": {
+      "locked": {
+        "lastModified": 1697303681,
+        "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
+        "owner": "nix-community",
+        "repo": "impermanence",
+        "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "master",
+        "repo": "impermanence",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1719254875,
@@ -214,6 +230,7 @@
         "flake-parts": "flake-parts",
         "futils": "futils",
         "home-manager": "home-manager",
+        "impermanence": "impermanence",
         "nixpkgs": "nixpkgs",
         "nur": "nur",
         "pre-commit-hooks": "pre-commit-hooks",
diff --git a/flake.nix b/flake.nix
index a07ee15..5a5b0ef 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,6 +43,13 @@
       };
     };
 
+    impermanence = {
+      type = "github";
+      owner = "nix-community";
+      repo = "impermanence";
+      ref = "master";
+    };
+
     nixpkgs = {
       type = "github";
       owner = "NixOS";
diff --git a/modules/nixos/hardware/bluetooth/default.nix b/modules/nixos/hardware/bluetooth/default.nix
index e9b1991..efce5c4 100644
--- a/modules/nixos/hardware/bluetooth/default.nix
+++ b/modules/nixos/hardware/bluetooth/default.nix
@@ -18,6 +18,13 @@ in
       services.blueman.enable = true;
     }
 
+    # Persist bluetooth files
+    {
+      my.system.persist.directories = [
+        "/var/lib/bluetooth"
+      ];
+    }
+
     # Support for additional bluetooth codecs
     (lib.mkIf cfg.loadExtraCodecs {
       hardware.pulseaudio = {
diff --git a/modules/nixos/hardware/networking/default.nix b/modules/nixos/hardware/networking/default.nix
index f0806fe..51dcfce 100644
--- a/modules/nixos/hardware/networking/default.nix
+++ b/modules/nixos/hardware/networking/default.nix
@@ -22,6 +22,11 @@ in
   config = lib.mkMerge [
     (lib.mkIf cfg.wireless.enable {
       networking.networkmanager.enable = true;
+
+      # Persist NetworkManager files
+      my.system.persist.directories = [
+        "/etc/NetworkManager/system-connections"
+      ];
     })
   ];
 }
diff --git a/modules/nixos/services/aria/default.nix b/modules/nixos/services/aria/default.nix
index 2d1b3e2..46fd8ee 100644
--- a/modules/nixos/services/aria/default.nix
+++ b/modules/nixos/services/aria/default.nix
@@ -72,5 +72,6 @@ in
     };
 
     # NOTE: unfortunately aria2 does not log connection failures for fail2ban
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/audiobookshelf/default.nix b/modules/nixos/services/audiobookshelf/default.nix
index 8c9719d..e4d03c2 100644
--- a/modules/nixos/services/audiobookshelf/default.nix
+++ b/modules/nixos/services/audiobookshelf/default.nix
@@ -35,5 +35,7 @@ in
         };
       };
     };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/blog/default.nix b/modules/nixos/services/blog/default.nix
index e4d2d42..aadc4f0 100644
--- a/modules/nixos/services/blog/default.nix
+++ b/modules/nixos/services/blog/default.nix
@@ -41,5 +41,12 @@ in
 
     # Those are all subdomains, no problem
     my.services.nginx.virtualHosts = hostsInfo;
+
+    my.system.persist.directories = [
+      "/var/www/blog"
+      "/var/www/cv"
+      "/var/www/dev"
+      "/var/www/key"
+    ];
   };
 }
diff --git a/modules/nixos/services/calibre-web/default.nix b/modules/nixos/services/calibre-web/default.nix
index b7bf9df..8a8af33 100644
--- a/modules/nixos/services/calibre-web/default.nix
+++ b/modules/nixos/services/calibre-web/default.nix
@@ -53,6 +53,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      "/var/lib/${config.services.calibre-web.dataDir}"
+      cfg.libraryPath
+    ];
+
     services.fail2ban.jails = {
       calibre-web = ''
         enabled = true
diff --git a/modules/nixos/services/flood/default.nix b/modules/nixos/services/flood/default.nix
index b95bac5..e1a2b74 100644
--- a/modules/nixos/services/flood/default.nix
+++ b/modules/nixos/services/flood/default.nix
@@ -27,5 +27,7 @@ in
         inherit (cfg) port;
       };
     };
+
+    # FIXME: persistence?
   };
 }
diff --git a/modules/nixos/services/forgejo/default.nix b/modules/nixos/services/forgejo/default.nix
index 18538be..8c36615 100644
--- a/modules/nixos/services/forgejo/default.nix
+++ b/modules/nixos/services/forgejo/default.nix
@@ -147,6 +147,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.gitea.lfs.contentDir
+      config.services.gitea.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       forgejo = ''
         enabled = true
diff --git a/modules/nixos/services/gitea/default.nix b/modules/nixos/services/gitea/default.nix
index 212f59c..20b3871 100644
--- a/modules/nixos/services/gitea/default.nix
+++ b/modules/nixos/services/gitea/default.nix
@@ -131,6 +131,11 @@ in
       ];
     };
 
+    my.system.persist.directories = [
+      config.services.gitea.lfs.contentDir
+      config.services.gitea.repositoryRoot
+    ];
+
     services.fail2ban.jails = {
       gitea = ''
         enabled = true
diff --git a/modules/nixos/services/grocy/default.nix b/modules/nixos/services/grocy/default.nix
index 87927d6..4a3183e 100644
--- a/modules/nixos/services/grocy/default.nix
+++ b/modules/nixos/services/grocy/default.nix
@@ -36,5 +36,8 @@ in
       forceSSL = true;
       useACMEHost = config.networking.domain;
     };
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/services/indexers/default.nix b/modules/nixos/services/indexers/default.nix
index 8a42345..332ae30 100644
--- a/modules/nixos/services/indexers/default.nix
+++ b/modules/nixos/services/indexers/default.nix
@@ -33,6 +33,10 @@ in
           port = jackettPort;
         };
       };
+
+      my.system.persist.directories = [
+        config.services.jackett.dataDir
+      ];
     })
 
     (lib.mkIf cfg.nzbhydra.enable {
@@ -45,6 +49,10 @@ in
           port = nzbhydraPort;
         };
       };
+
+      my.system.persist.directories = [
+        config.services.nzbhydra2.dataDir
+      ];
     })
 
     (lib.mkIf cfg.prowlarr.enable {
@@ -58,6 +66,10 @@ in
         };
       };
 
+      my.system.persist.directories = [
+        "/var/lib/${config.systemd.services.prowlarr.serviceConfig.StateDirectory}"
+      ];
+
       services.fail2ban.jails = {
         prowlarr = ''
           enabled = true
diff --git a/modules/nixos/services/jellyfin/default.nix b/modules/nixos/services/jellyfin/default.nix
index f5aaa99..e277b71 100644
--- a/modules/nixos/services/jellyfin/default.nix
+++ b/modules/nixos/services/jellyfin/default.nix
@@ -41,5 +41,9 @@ in
         };
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.jellyfin.serviceConfig.StateDirectory}"
+    ];
   };
 }
diff --git a/modules/nixos/services/lohr/default.nix b/modules/nixos/services/lohr/default.nix
index 21ed93b..64925a2 100644
--- a/modules/nixos/services/lohr/default.nix
+++ b/modules/nixos/services/lohr/default.nix
@@ -107,5 +107,9 @@ in
         };
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.lohr.serviceConfig.StateDirectory}"
+    ];
   };
 }
diff --git a/modules/nixos/services/matrix/default.nix b/modules/nixos/services/matrix/default.nix
index b958f76..145139f 100644
--- a/modules/nixos/services/matrix/default.nix
+++ b/modules/nixos/services/matrix/default.nix
@@ -253,5 +253,9 @@ in
         config.services.matrix-synapse.dataDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.matrix-synapse.dataDir
+    ];
   };
 }
diff --git a/modules/nixos/services/mealie/default.nix b/modules/nixos/services/mealie/default.nix
index 96b9e14..4fa4a6a 100644
--- a/modules/nixos/services/mealie/default.nix
+++ b/modules/nixos/services/mealie/default.nix
@@ -71,5 +71,8 @@ in
         };
       };
     };
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/services/miniflux/default.nix b/modules/nixos/services/miniflux/default.nix
index 5104c8b..448e0af 100644
--- a/modules/nixos/services/miniflux/default.nix
+++ b/modules/nixos/services/miniflux/default.nix
@@ -48,5 +48,8 @@ in
         inherit (cfg) port;
       };
     };
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/services/monitoring/default.nix b/modules/nixos/services/monitoring/default.nix
index 49919c1..4415cb5 100644
--- a/modules/nixos/services/monitoring/default.nix
+++ b/modules/nixos/services/monitoring/default.nix
@@ -130,5 +130,10 @@ in
         inherit (cfg.grafana) port;
       };
     };
+
+    my.system.persist.directories = [
+      config.services.grafana.dataDir
+      "/var/lib/${config.services.prometheus.stateDir}"
+    ];
   };
 }
diff --git a/modules/nixos/services/navidrome/default.nix b/modules/nixos/services/navidrome/default.nix
index 944a97a..8dd9748 100644
--- a/modules/nixos/services/navidrome/default.nix
+++ b/modules/nixos/services/navidrome/default.nix
@@ -52,5 +52,9 @@ in
         inherit (cfg) port;
       };
     };
+
+    my.system.persist.directories = [
+      "/var/lib/${config.systemd.services.navidrome.serviceConfig.StateDirectory}"
+    ];
   };
 }
diff --git a/modules/nixos/services/nextcloud/default.nix b/modules/nixos/services/nextcloud/default.nix
index bb3169a..ea30a90 100644
--- a/modules/nixos/services/nextcloud/default.nix
+++ b/modules/nixos/services/nextcloud/default.nix
@@ -87,5 +87,10 @@ in
         "${config.services.nextcloud.home}/data/appdata_*/preview"
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.nextcloud.home
+      config.services.nextcloud.datadir
+    ];
   };
 }
diff --git a/modules/nixos/services/nginx/default.nix b/modules/nixos/services/nginx/default.nix
index 7980ad9..4af2680 100644
--- a/modules/nixos/services/nginx/default.nix
+++ b/modules/nixos/services/nginx/default.nix
@@ -465,5 +465,9 @@ in
         }
       ];
     };
+
+    my.system.persist.directories = [
+      config.users.user.acme.home
+    ];
   };
 }
diff --git a/modules/nixos/services/paperless/default.nix b/modules/nixos/services/paperless/default.nix
index f62879a..d86be58 100644
--- a/modules/nixos/services/paperless/default.nix
+++ b/modules/nixos/services/paperless/default.nix
@@ -166,5 +166,10 @@ in
         config.services.paperless.mediaDir
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.paperless-ng.dataDir
+      config.services.paperless-ng.mediaDir
+    ];
   };
 }
diff --git a/modules/nixos/services/pirate/default.nix b/modules/nixos/services/pirate/default.nix
index e500b54..e0eae1e 100644
--- a/modules/nixos/services/pirate/default.nix
+++ b/modules/nixos/services/pirate/default.nix
@@ -18,6 +18,11 @@ let
       enable = true;
       group = "media";
     };
+
+    # Thankfully those old style services all define users with homes
+    my.system.persist.directories = [
+      config.users.user.${service}.home
+    ];
   };
 
   mkRedirection = service: {
diff --git a/modules/nixos/services/podgrab/default.nix b/modules/nixos/services/podgrab/default.nix
index ea89e4e..fad9553 100644
--- a/modules/nixos/services/podgrab/default.nix
+++ b/modules/nixos/services/podgrab/default.nix
@@ -51,5 +51,10 @@ in
         inherit (cfg) port;
       };
     };
+
+    my.system.persist.directories = [
+      config.systemd.services.podgrab.environment.CONFIG
+      config.systemd.services.podgrab.environment.DATA
+    ];
   };
 }
diff --git a/modules/nixos/services/postgresql-backup/default.nix b/modules/nixos/services/postgresql-backup/default.nix
index dff5494..3d6c03b 100644
--- a/modules/nixos/services/postgresql-backup/default.nix
+++ b/modules/nixos/services/postgresql-backup/default.nix
@@ -24,5 +24,9 @@ in
         (config.services.postgresqlBackup.location + "/*.prev.sql.gz")
       ];
     };
+
+    my.system.persist.directories = [
+      config.services.postgresqlBackup.location
+    ];
   };
 }
diff --git a/modules/nixos/services/postgresql/default.nix b/modules/nixos/services/postgresql/default.nix
index bbe46d4..cea4c88 100644
--- a/modules/nixos/services/postgresql/default.nix
+++ b/modules/nixos/services/postgresql/default.nix
@@ -18,6 +18,13 @@ in
       };
     })
 
+    # Only persist directory if the actual service is enabled
+    (lib.mkIf config.services.postgresql.enable {
+      my.system.persist.directories = [
+        config.services.postgresql.dataDir
+      ];
+    })
+
     # Taken from the manual
     (lib.mkIf cfg.upgradeScript {
       environment.systemPackages =
diff --git a/modules/nixos/services/pyload/default.nix b/modules/nixos/services/pyload/default.nix
index 88889bf..1e5ce61 100644
--- a/modules/nixos/services/pyload/default.nix
+++ b/modules/nixos/services/pyload/default.nix
@@ -54,5 +54,7 @@ in
     };
 
     # FIXME: fail2ban
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/services/quassel/default.nix b/modules/nixos/services/quassel/default.nix
index 695f9e0..0065195 100644
--- a/modules/nixos/services/quassel/default.nix
+++ b/modules/nixos/services/quassel/default.nix
@@ -46,5 +46,9 @@ in
       # Because Quassel does not use the socket, I simply trust its connection
       authentication = "host quassel quassel localhost trust";
     };
+
+    my.system.persist.directories = [
+      config.services.quassel.dataDir
+    ];
   };
 }
diff --git a/modules/nixos/services/rss-bridge/default.nix b/modules/nixos/services/rss-bridge/default.nix
index 52b1030..977b431 100644
--- a/modules/nixos/services/rss-bridge/default.nix
+++ b/modules/nixos/services/rss-bridge/default.nix
@@ -22,5 +22,9 @@ in
       forceSSL = true;
       useACMEHost = config.networking.domain;
     };
+
+    my.system.persist.directories = [
+      config.services.rss-bridge.dataDir
+    ];
   };
 }
diff --git a/modules/nixos/services/sabnzbd/default.nix b/modules/nixos/services/sabnzbd/default.nix
index 9e0d9c3..86202ab 100644
--- a/modules/nixos/services/sabnzbd/default.nix
+++ b/modules/nixos/services/sabnzbd/default.nix
@@ -24,6 +24,10 @@ in
       };
     };
 
+    my.system.persist.files = [
+      config.services.sabnzbd.configFile
+    ];
+
     services.fail2ban.jails = {
       sabnzbd = ''
         enabled = true
diff --git a/modules/nixos/services/ssh-server/default.nix b/modules/nixos/services/ssh-server/default.nix
index 9ae0fa8..0cabc6f 100644
--- a/modules/nixos/services/ssh-server/default.nix
+++ b/modules/nixos/services/ssh-server/default.nix
@@ -20,6 +20,14 @@ in
       };
     };
 
+    # Persist SSH keys
+    my.system.persist.files = [
+      "/etc/ssh/ssh_host_ed25519_key"
+      "/etc/ssh/ssh_host_ed25519_key.pub"
+      "/etc/ssh/ssh_host_rsa_key"
+      "/etc/ssh/ssh_host_rsa_key.pub"
+    ];
+
     # Opens the relevant UDP ports.
     programs.mosh.enable = true;
   };
diff --git a/modules/nixos/services/tandoor-recipes/default.nix b/modules/nixos/services/tandoor-recipes/default.nix
index 48ad7a8..a404033 100644
--- a/modules/nixos/services/tandoor-recipes/default.nix
+++ b/modules/nixos/services/tandoor-recipes/default.nix
@@ -82,5 +82,8 @@ in
         };
       };
     };
+
+    # FIXME: backup
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/services/transmission/default.nix b/modules/nixos/services/transmission/default.nix
index aeb88b7..e921bfa 100644
--- a/modules/nixos/services/transmission/default.nix
+++ b/modules/nixos/services/transmission/default.nix
@@ -90,5 +90,9 @@ in
       allowedTCPPorts = [ cfg.peerPort ];
       allowedUDPPorts = [ cfg.peerPort ];
     };
+
+    my.system.persist.directories = [
+      config.services.transmission.home
+    ];
   };
 }
diff --git a/modules/nixos/services/vikunja/default.nix b/modules/nixos/services/vikunja/default.nix
index 6e7700f..262c199 100644
--- a/modules/nixos/services/vikunja/default.nix
+++ b/modules/nixos/services/vikunja/default.nix
@@ -99,5 +99,7 @@ in
         config.services.vikunja.settings.files.basepath
       ];
     };
+
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/services/woodpecker/server/default.nix b/modules/nixos/services/woodpecker/server/default.nix
index adf533e..5d25284 100644
--- a/modules/nixos/services/woodpecker/server/default.nix
+++ b/modules/nixos/services/woodpecker/server/default.nix
@@ -61,5 +61,7 @@ in
         port = cfg.rpcPort;
       };
     };
+
+    # FIXME: persistence
   };
 }
diff --git a/modules/nixos/system/default.nix b/modules/nixos/system/default.nix
index e6fb25b..3531847 100644
--- a/modules/nixos/system/default.nix
+++ b/modules/nixos/system/default.nix
@@ -9,6 +9,7 @@
     ./language
     ./nix
     ./packages
+    ./persist
     ./podman
     ./polkit
     ./printing
diff --git a/modules/nixos/system/persist/default.nix b/modules/nixos/system/persist/default.nix
new file mode 100644
index 0000000..7346936
--- /dev/null
+++ b/modules/nixos/system/persist/default.nix
@@ -0,0 +1,69 @@
+# Ephemeral root configuration
+{ config, inputs, lib, ... }:
+let
+  cfg = config.my.system.persist;
+in
+{
+  imports = [
+    inputs.impermanence.nixosModules.impermanence
+  ];
+
+  options.my.system.persist = with lib; {
+    enable = mkEnableOption "stateless system configuration";
+
+    mountPoint = lib.mkOption {
+      type = types.str;
+      default = "/persistent";
+      example = "/etc/nix/persist";
+      description = ''
+        Which mount point should be used to persist this system's files and
+        directories.
+      '';
+    };
+
+    files = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "/etc/nix/id_rsa"
+      ];
+      description = ''
+        Additional files in the root to link to persistent storage.
+      '';
+    };
+
+    directories = lib.mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "/var/lib/libvirt"
+      ];
+      description = ''
+        Additional directories in the root to link to persistent storage.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.persistence."${cfg.mountPoint}" = {
+      files = [
+        "/etc/machine-id"
+      ]
+      ++ cfg.files
+      ;
+
+      directories = [
+        "/etc/nixos"
+        "/var/log"
+        "/var/lib/nixos"
+        "/var/lib/systemd/coredump"
+      ]
+      ++ (lib.optionals config.virtualisation.docker.enable [
+        "/var/lib/docker"
+      ])
+      # FIXME: podman
+      ++ cfg.directories
+      ;
+    };
+  };
+}