diff --git a/kopia_backup/defaults/main.yml b/kopia_backup/defaults/main.yml
index d627520..e33df93 100644
--- a/kopia_backup/defaults/main.yml
+++ b/kopia_backup/defaults/main.yml
@@ -15,6 +15,8 @@ kopia_backup:
   sources: []
   # source path -> ignore rules, replacing the policy rules on every run (null drops one).
   ignore: {}
+  # Command run first, e.g. a host script writing dumps into a source; a failure fails the run, the snapshot still runs.
+  pre_command: ""
   # Database dumps written to /var/backups/dumps before the snapshot, which then includes that directory.
   # Each item: file, container, command (run with sh -c inside the container, output is the dump).
   dumps: []
diff --git a/kopia_backup/tasks/main.yml b/kopia_backup/tasks/main.yml
index deb5be5..121dd8a 100644
--- a/kopia_backup/tasks/main.yml
+++ b/kopia_backup/tasks/main.yml
@@ -15,6 +15,11 @@
     state: directory
     mode: "0755"
 
+- name: Install gpg for the apt key
+  ansible.builtin.apt:
+    name: gpg
+    state: present
+
 - name: Add the Kopia apt key
   ansible.builtin.shell: curl -fsSL https://kopia.io/signing-key | gpg --dearmor -o /etc/apt/keyrings/kopia-keyring.gpg
   args:
diff --git a/kopia_backup/templates/kopia-backup.j2 b/kopia_backup/templates/kopia-backup.j2
index c4d904f..90787aa 100644
--- a/kopia_backup/templates/kopia-backup.j2
+++ b/kopia_backup/templates/kopia-backup.j2
@@ -5,6 +5,10 @@ set -uo pipefail
 export KOPIA_CHECK_FOR_UPDATES=false
 failed=0
 sources=()
+{% if kopia_backup.pre_command %}
+
+{{ kopia_backup.pre_command }} || { echo "pre_command failed" >&2; failed=1; }
+{% endif %}
 {% if kopia_backup.etcd_snapshot %}
 
 # Only the latest etcd snapshot; the live etcd dir is not consistent on disk and older snapshots only add churn