diff --git a/rook-ceph/kustomization.yaml b/rook-ceph/kustomization.yaml
index bbb083d..f499ef9 100644
--- a/rook-ceph/kustomization.yaml
+++ b/rook-ceph/kustomization.yaml
@@ -65,6 +65,7 @@ helmCharts:
 resources:
 # - ssh://git@git.k-space.ee/secretspace/kube/rook-ceph # secrets: rook-ceph-external-admin-secret
 - ./storage-classes.yaml
+- ./snapshot-classes.yaml
 
 patches:
 # External cluster has no client.admin - make bare ceph/rbd commands in the
diff --git a/rook-ceph/snapshot-classes.yaml b/rook-ceph/snapshot-classes.yaml
new file mode 100644
index 0000000..d8f8a77
--- /dev/null
+++ b/rook-ceph/snapshot-classes.yaml
@@ -0,0 +1,36 @@
+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: ceph-rbd
+  annotations:
+    kubernetes.io/description: |
+      Snapshot class for all RBD-backed storage classes (ceph-rbd, hdd-ceph,
+      mongo, prometheus, unifi, gitea, nextcloud, woodpecker, rabbitmq).
+      Snapshots are copy-on-write inside the Ceph pool, so they are near
+      instant and cost only the changed blocks. They live in the same Ceph
+      cluster as the volume: useful for rollback before a risky change, and
+      as the consistent source for an off-cluster backup, but not a backup
+      in themselves.
+    snapshot.storage.kubernetes.io/is-default-class: "true"
+driver: rook-ceph.rbd.csi.ceph.com
+parameters:
+  clusterID: rook-ceph
+  csi.storage.k8s.io/snapshotter-secret-name: rook-csi-rbd-provisioner
+  csi.storage.k8s.io/snapshotter-secret-namespace: rook-ceph
+deletionPolicy: Delete
+---
+apiVersion: snapshot.storage.k8s.io/v1
+kind: VolumeSnapshotClass
+metadata:
+  name: cephfs
+  annotations:
+    kubernetes.io/description: |
+      Snapshot class for the cephfs storage class. Same caveat as ceph-rbd:
+      the snapshot stays inside the Ceph cluster.
+driver: rook-ceph.cephfs.csi.ceph.com
+parameters:
+  clusterID: rook-ceph
+  csi.storage.k8s.io/snapshotter-secret-name: rook-csi-cephfs-provisioner
+  csi.storage.k8s.io/snapshotter-secret-namespace: rook-ceph
+deletionPolicy: Delete