diff --git a/nixos/modules/services/backup/borgbackup.nix b/nixos/modules/services/backup/borgbackup.nix
index 2512f4643c68..59581daeb721 100644
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@@ -206,16 +206,17 @@ let
       original,
       name,
       set ? { },
+      extraArgs ? null,
     }:
     pkgs.runCommand "${name}-wrapper"
       {
         nativeBuildInputs = [ pkgs.makeWrapper ];
       }
-
       ''
         makeWrapper "${original}" "$out/bin/${name}" \
           ${lib.concatStringsSep " \\\n " (
-            lib.mapAttrsToList (name: value: ''--set ${name} "${value}"'') set
+            (lib.mapAttrsToList (name: value: ''--set ${name} "${value}"'') set)
+            ++ (lib.optional (extraArgs != null) ''--add-flags "${extraArgs}"'')
           )}
       '';
 
@@ -230,6 +231,7 @@ let
       }
       // (mkPassEnv cfg)
       // cfg.environment;
+      extraArgs = cfg.extraArgs or null;
     });
 
   # Paths listed in ReadWritePaths must exist before service is started
@@ -778,6 +780,9 @@ in
               description = ''
                 Additional arguments for all {command}`borg` calls the
                 service has. Handle with care.
+
+                These extra arguments also get included in the wrapper
+                script for this job.
               '';
               default = [ ];
               example = [ "--remote-path=/path/to/borg" ];
diff --git a/nixos/tests/borgbackup.nix b/nixos/tests/borgbackup.nix
index d26ad166de5d..a52b9d80ee84 100644
--- a/nixos/tests/borgbackup.nix
+++ b/nixos/tests/borgbackup.nix
@@ -131,7 +131,8 @@ in
             repo = remoteRepo;
             encryption.mode = "none";
             startAt = [ ];
-            environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+            # This uses extraArgs instead of BORG_RSH to test propagation of these args
+            extraArgs = [ "--rsh=ssh -oStrictHostKeyChecking=no -i /root/id_ed25519" ];
           };
 
           commandFail = {