diff --git a/hosts/nas/ssh/config.local b/hosts/nas/ssh/config.local
index 14f9f27..a01e502 100644
--- a/hosts/nas/ssh/config.local
+++ b/hosts/nas/ssh/config.local
@@ -1 +1,19 @@
-# No machine-specific ssh aliases on the NAS.
+# Hetzner Storage Box. Port 23, not 22 -- that is the usual first stumble.
+#
+# This alias is what restic-backup's RESTIC_REPOSITORY (sftp:storagebox:...)
+# resolves through, so losing it takes the nightly backup down with it. It was
+# dropped on 2026-09-14 by "Split ssh config into common plus a host layer",
+# which restored system76's aliases verbatim but stubbed nas and mainframe out
+# as having none -- the two machines that actually run restic. The NAS backup
+# then failed every night from 2026-09-15 with "Could not resolve hostname
+# storagebox". mainframe was unaffected only because its job runs as root and
+# reads /root/.ssh/config, which is not managed by dotbot.
+#
+# sub2, not sub1: the two hosts share one Storage Box account but are chrooted
+# into separate sub-account homes, so mainframe cannot see this repo.
+Host storagebox
+    HostName     u491382.your-storagebox.de
+    User         u491382-sub2
+    Port         23
+    IdentityFile ~/.ssh/id_storagebox
+    PreferredAuthentications publickey