diff --git a/backend/Program.cs b/backend/Program.cs
index af3ad12..f361f5f 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -3,10 +3,19 @@ using backend.Data;
 using backend.Devices;
 using backend.Install;
 using backend.Pairing;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
 
 var builder = WebApplication.CreateBuilder(args);
 
+var keysDir = Environment.GetEnvironmentVariable("DataProtection__KeysDir") ?? "/keys";
+if (Directory.Exists(keysDir))
+{
+    builder.Services.AddDataProtection()
+        .PersistKeysToFileSystem(new DirectoryInfo(keysDir))
+        .SetApplicationName("smart-assistant");
+}
+
 builder.Services.AddDbContext<AppDbContext>(opt =>
     opt.UseSqlite(builder.Configuration.GetConnectionString("Default")));
 
diff --git a/backend/backend.csproj b/backend/backend.csproj
index 2464226..a1f5226 100644
--- a/backend/backend.csproj
+++ b/backend/backend.csproj
@@ -7,6 +7,7 @@
   </PropertyGroup>
 
   <ItemGroup>
+    <PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="9.*" />
     <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="9.*" />
     <PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="9.*">
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>