diff --git a/modules/darling-erasure.nix b/modules/darling-erasure/default.nix
similarity index 92%
rename from modules/darling-erasure.nix
rename to modules/darling-erasure/default.nix
index e9ed79c..9a44d0a 100644
--- a/modules/darling-erasure.nix
+++ b/modules/darling-erasure/default.nix
@@ -8,6 +8,8 @@
     adjtime.source = "/persist/etc/adjtime";
     NIXOS.source = "/persist/etc/NIXOS";
     machine-id.source = "/persist/etc/machine-id";
+    ssh.source = "/persist/etc/ssh";
+    shadow.source = "/persist/etc/shadow";
   };
   systemd.tmpfiles.rules = [
     "L /var/lib/NetworkManager/secret_key - - - - /persist/var/lib/NetworkManager/secret_key"
@@ -58,4 +60,7 @@
     # we can unmount /mnt and continue on the boot process.
     umount /mnt
   '';
+
+  # In case one forgets to move /etc/shadow to /persist
+  users.users.moritz.initialPassword = "password";
 }
diff --git a/modules/darling-erasure/fs-diff.sh b/modules/darling-erasure/fs-diff.sh
new file mode 100755
index 0000000..bd581d0
--- /dev/null
+++ b/modules/darling-erasure/fs-diff.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# fs-diff.sh
+set -euo pipefail
+
+OLD_TRANSID=$(sudo btrfs subvolume find-new /mnt/root-blank 9999999)
+OLD_TRANSID=${OLD_TRANSID#transid marker was }
+
+sudo btrfs subvolume find-new "/mnt/root" "$OLD_TRANSID" |
+sed '$d' |
+cut -f17- -d' ' |
+sort |
+uniq |
+while read path; do
+  path="/$path"
+  if [ -L "$path" ]; then
+    : # The path is a symbolic link, so is probably handled by NixOS already
+  elif [ -d "$path" ]; then
+    : # The path is a directory, ignore
+  else
+    echo "$path"
+  fi
+done
diff --git a/modules/darling-erasure/initalize-persist.sh b/modules/darling-erasure/initalize-persist.sh
new file mode 100644
index 0000000..0172773
--- /dev/null
+++ b/modules/darling-erasure/initalize-persist.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+sudo mkdir -p /persist/etc/NetworkManager
+sudo cp -r {,/persist}/etc/NetworkManager/system-connections
+sudo mkdir -p /persist/var/lib/NetworkManager
+sudo cp /var/lib/NetworkManager/{secret_key,seen-bssids,timestamps} /persist/var/lib/NetworkManager/
+
+sudo cp -r {,/persist}/etc/nixos
+sudo cp {,/persist}/etc/adjtime
+sudo cp {,/persist}/etc/NIXOS
+
+sudo cp -r {,/persist}/etc/ssh
+sudo cp {,/persist}/etc/shadow