diff --git a/playbooks/adm.yml b/playbooks/adm.yml
index fbe2b96..f424596 100644
--- a/playbooks/adm.yml
+++ b/playbooks/adm.yml
@@ -180,14 +180,3 @@
         mode: "0755"
         owner: root
         group: "{{ ansible_wheel }}"
-
-    - name: Create sw-backup script
-      ansible.builtin.copy:
-        dest: /usr/local/bin/sw-backup
-        content: |
-          #!/bin/sh
-          set -eu
-          ssh "admin@${1}" /export > "/srv/backup/${1}.rsc"
-        mode: "0755"
-        owner: root
-        group: "{{ ansible_wheel }}"
diff --git a/roles/routeros/files/sw-backup.sh b/roles/routeros/files/sw-backup.sh
new file mode 100755
index 0000000..f6626d5
--- /dev/null
+++ b/roles/routeros/files/sw-backup.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -eu
+umask 022
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $(basename "$0") <hostname>" 1>&2
+    exit 1
+fi
+
+ssh "admin@${1}" /export > "/srv/backup/${1}.rsc"
diff --git a/roles/routeros/tasks/main.yml b/roles/routeros/tasks/main.yml
index 356995d..1907ce9 100644
--- a/roles/routeros/tasks/main.yml
+++ b/roles/routeros/tasks/main.yml
@@ -101,3 +101,11 @@
     mode: "0644"
     owner: root
     group: "{{ ansible_wheel }}"
+
+- name: Copy sw-backup script
+  ansible.builtin.copy:
+    dest: /usr/local/bin/sw-backup
+    src: sw-backup.sh
+    mode: "0755"
+    owner: root
+    group: "{{ ansible_wheel }}"