diff --git a/backend/src/routes/backup.js b/backend/src/routes/backup.js
index 2d46881..5505605 100644
--- a/backend/src/routes/backup.js
+++ b/backend/src/routes/backup.js
@@ -68,7 +68,7 @@ export async function runBackupJob(job, instance = null) {
       });
     });
     try {
-      await spawnCommand('restic', ['backup', '--stdin', '--stdin-filename', `${job.vmName}.raw`, '--tag', job.vmName], {
+      await spawnCommand('restic', ['backup', '--stdin', '--stdin-filename', `${job.vmName}.raw`, '--tag', job.vmName, '--tag', 'data', '--tag', 'virtual-machine'], {
         env: { ...process.env, ...config.resticEnv },
         input: snapshotStream.pipe(progressStream),
         log: (line) => appendJobLog(job, line),
@@ -134,7 +134,7 @@ async function runContainerBackupJob(job) {
     });
     let resticOk = false;
     try {
-      await spawnCommand('restic', ['backup', '--stdin', '--stdin-filename', `${job.vmName}.zfs`, '--tag', job.vmName, '--tag', 'container'], {
+      await spawnCommand('restic', ['backup', '--stdin', '--stdin-filename', `${job.vmName}.zfs`, '--tag', job.vmName, '--tag', 'data', '--tag', 'container'], {
         env: { ...process.env, ...config.resticEnv },
         input: zfs.stdout.pipe(progressStream),
         log: (line) => appendJobLog(job, line),
diff --git a/backend/src/validators.js b/backend/src/validators.js
index cf0b7a9..7e9b8dc 100644
--- a/backend/src/validators.js
+++ b/backend/src/validators.js
@@ -46,7 +46,9 @@ export async function listSnapshotsForVm(vmName) {
   await validateVmExists(vmName);
   const result = await runRestic(['--no-lock', 'snapshots', '--json', '--tag', vmName]);
   const snapshots = JSON.parse(result.stdout || '[]');
-  return snapshots.sort((a, b) => String(b.time || '').localeCompare(String(a.time || '')));
+  return snapshots
+    .filter((snapshot) => !(snapshot.tags || []).includes('metadata'))
+    .sort((a, b) => String(b.time || '').localeCompare(String(a.time || '')));
 }
 
 export async function validateSnapshotForVm(vmName, snapshotId) {