diff --git a/lib/backup.ts b/lib/backup.ts
index b05f59a..0923e6e 100644
--- a/lib/backup.ts
+++ b/lib/backup.ts
@@ -14,7 +14,7 @@ async function runBackup(): Promise<void> {
     return;
   }
   const [, sshHost, remotePath] = match;
-  const rawKeyPath = process.env.BACKUP_SSH_KEY_PATH || '/app/.ssh/id_rsa';
+  const rawKeyPath = process.env.BACKUP_SSH_KEY_PATH || '';
   const keyPath = rawKeyPath.startsWith('~')
     ? rawKeyPath.replace('~', process.env.HOME || '/root')
     : rawKeyPath;
@@ -29,17 +29,17 @@ async function runBackup(): Promise<void> {
   const dbName = process.env.DB_NAME || 'sternwarte';
 
   const sshOpts = [
-    '-i', keyPath,
+    ...(keyPath ? ['-i', keyPath] : []),
     '-o', 'StrictHostKeyChecking=no',
     '-o', 'BatchMode=yes',
   ];
 
   await new Promise<void>((resolve, reject) => {
     const dump = spawn('mysqldump', [
-      `-h${dbHost}`, `-P${dbPort}`, `-u${dbUser}`, `-p${dbPass}`,
+      `-h${dbHost}`, `-P${dbPort}`, `-u${dbUser}`,
       `--ignore-table=${dbName}.beos`,
       dbName,
-    ]);
+    ], { env: { ...process.env, MYSQL_PWD: dbPass } });
     const gzip = spawn('gzip');
     const ssh = spawn('ssh', [...sshOpts, sshHost, `cat > ${remotePath}/${filename}`]);