diff --git a/hosts/pie/paperless.nix b/hosts/pie/paperless.nix
index 50518d9..ca5a793 100644
--- a/hosts/pie/paperless.nix
+++ b/hosts/pie/paperless.nix
@@ -121,7 +121,7 @@ in {
   services.cron = {
     enable = true;
     systemCronJobs = [
-      "30 1 * * * paperless ${pkgs.fetch-hostingde-invoices}/bin/fetch-hostingde-invoices '${config.age.secrets."hosting-de-invoice-sync-api-key".path}' '${consumptionDir}'"
+      "30 1 * * * paperless ${pkgs.fetch-hostingde-invoices}/bin/fetch-hostingde-invoices '${config.age.secrets."hosting-de-invoice-sync-api-key".path}' '${consumptionDir}' /var/lib/fetch-hostingde-invoices/ids"
     ];
   };
 
@@ -134,6 +134,7 @@ in {
     "d '${backupDir}' 0700 paperless users - -"
     "d '${consumptionDir}' 0700 paperless users - -"
     "d /tmp/paperless 0700 paperless users - -"
+    "d /var/lib/fetch-hostingde-invoices 0700 paperless users - -"
   ];
 
   age.secrets."rclone-pubsolar.conf" = {
@@ -148,7 +149,10 @@ in {
 
   services.restic.backups = {
     paperless = {
-      paths = [backupDir];
+      paths = [
+        backupDir
+        "/var/lib/fetch-hostingde-invoices"
+      ];
       initialize = true;
       passwordFile = config.age.secrets."restic-password".path;
       # See https://www.hosting.de/blog/verschluesselte-backups-mit-rclone-und-restic-in-nextcloud/
diff --git a/pkgs/fetch-hostingde-invoices.nix b/pkgs/fetch-hostingde-invoices.nix
index a365e1b..7c53a32 100644
--- a/pkgs/fetch-hostingde-invoices.nix
+++ b/pkgs/fetch-hostingde-invoices.nix
@@ -2,16 +2,17 @@ self:
 with self; ''
 set -e
 
-PATH="$PATH:${jq}/bin:${curl}/bin"
+PATH="$PATH:${jq}/bin:${curl}/bin:${coreutils}/bin:${gnugrep}/bin"
 
 SECRET_FILE=$1
 OUT_DIR=$2
+STATE_FILE=$3
 
 AUTH_TOKEN=$(cat $SECRET_FILE)
 
 CURL_BODY=$(cat <<EOF
 {
-  "limit": 10,
+  "limit": 30,
   "sort": {
     "field": "documentDate",
     "order": "DESC"
@@ -24,6 +25,11 @@ echo "fetching $CURL_URL";
 documents=$(curl -X POST -H "Content-Type: application/json" -H "Accept: application/json" -d "$CURL_BODY" "$CURL_URL" | jq '.response.data.[].documentId' -rc)
 
 for doc in $documents; do
+  if [ $(grep "$doc" "$STATE_FILE" | wc -l) -gt 0 ]; then
+    echo "Skipping already fetched $doc"
+    continue
+  fi
+
   CURL_BODY=$(cat <<EOF
   {
     "id": "$doc",
@@ -34,5 +40,6 @@ EOF)
   echo "fetching $doc";
   url=$(curl -X POST -H "Content-Type: application/json" -H "Accept: application/json" -d "$CURL_BODY" "$CURL_URL" | jq '.response' -rc)
   curl $url >> "$OUT_DIR/$doc.pdf"
+  echo "$doc" >> $STATE_FILE
 done
 ''