diff --git a/doc/bash-completion.sh b/doc/bash-completion.sh
index 42f459f65..44221554e 100644
--- a/doc/bash-completion.sh
+++ b/doc/bash-completion.sh
@@ -414,6 +414,12 @@ _restic_backup()
     flags+=("-f")
     local_nonpersistent_flags+=("--force")
     local_nonpersistent_flags+=("-f")
+    flags+=("--group-by=")
+    two_word_flags+=("--group-by")
+    two_word_flags+=("-g")
+    local_nonpersistent_flags+=("--group-by")
+    local_nonpersistent_flags+=("--group-by=")
+    local_nonpersistent_flags+=("-g")
     flags+=("--help")
     flags+=("-h")
     local_nonpersistent_flags+=("--help")
@@ -500,6 +506,8 @@ _restic_backup()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -570,6 +578,8 @@ _restic_cache()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -632,6 +642,8 @@ _restic_cat()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -702,6 +714,8 @@ _restic_check()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -798,6 +812,8 @@ _restic_copy()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -862,6 +878,8 @@ _restic_diff()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -944,6 +962,8 @@ _restic_dump()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -980,6 +1000,8 @@ _restic_find()
     local_nonpersistent_flags+=("--host")
     local_nonpersistent_flags+=("--host=")
     local_nonpersistent_flags+=("-H")
+    flags+=("--human-readable")
+    local_nonpersistent_flags+=("--human-readable")
     flags+=("--ignore-case")
     flags+=("-i")
     local_nonpersistent_flags+=("--ignore-case")
@@ -1054,6 +1076,8 @@ _restic_find()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1222,6 +1246,8 @@ _restic_forget()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1304,6 +1330,8 @@ _restic_generate()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1362,6 +1390,8 @@ _restic_help()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1451,6 +1481,8 @@ _restic_init()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1525,6 +1557,8 @@ _restic_key()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1587,6 +1621,8 @@ _restic_list()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1621,6 +1657,8 @@ _restic_ls()
     local_nonpersistent_flags+=("--host")
     local_nonpersistent_flags+=("--host=")
     local_nonpersistent_flags+=("-H")
+    flags+=("--human-readable")
+    local_nonpersistent_flags+=("--human-readable")
     flags+=("--long")
     flags+=("-l")
     local_nonpersistent_flags+=("--long")
@@ -1669,6 +1707,8 @@ _restic_ls()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1735,6 +1775,8 @@ _restic_migrate()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1825,6 +1867,8 @@ _restic_mount()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -1909,70 +1953,8 @@ _restic_prune()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
-    flags+=("--tls-client-cert=")
-    two_word_flags+=("--tls-client-cert")
-    flags+=("--verbose")
-    flags+=("-v")
-
-    must_have_one_flag=()
-    must_have_one_noun=()
-    noun_aliases=()
-}
-
-_restic_rebuild-index()
-{
-    last_command="restic_rebuild-index"
-
-    command_aliases=()
-
-    commands=()
-
-    flags=()
-    two_word_flags=()
-    local_nonpersistent_flags=()
-    flags_with_completion=()
-    flags_completion=()
-
-    flags+=("--help")
-    flags+=("-h")
-    local_nonpersistent_flags+=("--help")
-    local_nonpersistent_flags+=("-h")
-    flags+=("--read-all-packs")
-    local_nonpersistent_flags+=("--read-all-packs")
-    flags+=("--cacert=")
-    two_word_flags+=("--cacert")
-    flags+=("--cache-dir=")
-    two_word_flags+=("--cache-dir")
-    flags+=("--cleanup-cache")
-    flags+=("--compression=")
-    two_word_flags+=("--compression")
-    flags+=("--insecure-tls")
-    flags+=("--json")
-    flags+=("--key-hint=")
-    two_word_flags+=("--key-hint")
-    flags+=("--limit-download=")
-    two_word_flags+=("--limit-download")
-    flags+=("--limit-upload=")
-    two_word_flags+=("--limit-upload")
-    flags+=("--no-cache")
-    flags+=("--no-lock")
-    flags+=("--option=")
-    two_word_flags+=("--option")
-    two_word_flags+=("-o")
-    flags+=("--pack-size=")
-    two_word_flags+=("--pack-size")
-    flags+=("--password-command=")
-    two_word_flags+=("--password-command")
-    flags+=("--password-file=")
-    two_word_flags+=("--password-file")
-    two_word_flags+=("-p")
-    flags+=("--quiet")
-    flags+=("-q")
-    flags+=("--repo=")
-    two_word_flags+=("--repo")
-    two_word_flags+=("-r")
-    flags+=("--repository-file=")
-    two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2035,6 +2017,286 @@ _restic_recover()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
+    flags+=("--tls-client-cert=")
+    two_word_flags+=("--tls-client-cert")
+    flags+=("--verbose")
+    flags+=("-v")
+
+    must_have_one_flag=()
+    must_have_one_noun=()
+    noun_aliases=()
+}
+
+_restic_repair_help()
+{
+    last_command="restic_repair_help"
+
+    command_aliases=()
+
+    commands=()
+
+    flags=()
+    two_word_flags=()
+    local_nonpersistent_flags=()
+    flags_with_completion=()
+    flags_completion=()
+
+    flags+=("--cacert=")
+    two_word_flags+=("--cacert")
+    flags+=("--cache-dir=")
+    two_word_flags+=("--cache-dir")
+    flags+=("--cleanup-cache")
+    flags+=("--compression=")
+    two_word_flags+=("--compression")
+    flags+=("--insecure-tls")
+    flags+=("--json")
+    flags+=("--key-hint=")
+    two_word_flags+=("--key-hint")
+    flags+=("--limit-download=")
+    two_word_flags+=("--limit-download")
+    flags+=("--limit-upload=")
+    two_word_flags+=("--limit-upload")
+    flags+=("--no-cache")
+    flags+=("--no-lock")
+    flags+=("--option=")
+    two_word_flags+=("--option")
+    two_word_flags+=("-o")
+    flags+=("--pack-size=")
+    two_word_flags+=("--pack-size")
+    flags+=("--password-command=")
+    two_word_flags+=("--password-command")
+    flags+=("--password-file=")
+    two_word_flags+=("--password-file")
+    two_word_flags+=("-p")
+    flags+=("--quiet")
+    flags+=("-q")
+    flags+=("--repo=")
+    two_word_flags+=("--repo")
+    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
+    flags+=("--tls-client-cert=")
+    two_word_flags+=("--tls-client-cert")
+    flags+=("--verbose")
+    flags+=("-v")
+
+    must_have_one_flag=()
+    must_have_one_noun=()
+    has_completion_function=1
+    noun_aliases=()
+}
+
+_restic_repair_index()
+{
+    last_command="restic_repair_index"
+
+    command_aliases=()
+
+    commands=()
+
+    flags=()
+    two_word_flags=()
+    local_nonpersistent_flags=()
+    flags_with_completion=()
+    flags_completion=()
+
+    flags+=("--help")
+    flags+=("-h")
+    local_nonpersistent_flags+=("--help")
+    local_nonpersistent_flags+=("-h")
+    flags+=("--read-all-packs")
+    local_nonpersistent_flags+=("--read-all-packs")
+    flags+=("--cacert=")
+    two_word_flags+=("--cacert")
+    flags+=("--cache-dir=")
+    two_word_flags+=("--cache-dir")
+    flags+=("--cleanup-cache")
+    flags+=("--compression=")
+    two_word_flags+=("--compression")
+    flags+=("--insecure-tls")
+    flags+=("--json")
+    flags+=("--key-hint=")
+    two_word_flags+=("--key-hint")
+    flags+=("--limit-download=")
+    two_word_flags+=("--limit-download")
+    flags+=("--limit-upload=")
+    two_word_flags+=("--limit-upload")
+    flags+=("--no-cache")
+    flags+=("--no-lock")
+    flags+=("--option=")
+    two_word_flags+=("--option")
+    two_word_flags+=("-o")
+    flags+=("--pack-size=")
+    two_word_flags+=("--pack-size")
+    flags+=("--password-command=")
+    two_word_flags+=("--password-command")
+    flags+=("--password-file=")
+    two_word_flags+=("--password-file")
+    two_word_flags+=("-p")
+    flags+=("--quiet")
+    flags+=("-q")
+    flags+=("--repo=")
+    two_word_flags+=("--repo")
+    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
+    flags+=("--tls-client-cert=")
+    two_word_flags+=("--tls-client-cert")
+    flags+=("--verbose")
+    flags+=("-v")
+
+    must_have_one_flag=()
+    must_have_one_noun=()
+    noun_aliases=()
+}
+
+_restic_repair_snapshots()
+{
+    last_command="restic_repair_snapshots"
+
+    command_aliases=()
+
+    commands=()
+
+    flags=()
+    two_word_flags=()
+    local_nonpersistent_flags=()
+    flags_with_completion=()
+    flags_completion=()
+
+    flags+=("--dry-run")
+    flags+=("-n")
+    local_nonpersistent_flags+=("--dry-run")
+    local_nonpersistent_flags+=("-n")
+    flags+=("--forget")
+    local_nonpersistent_flags+=("--forget")
+    flags+=("--help")
+    flags+=("-h")
+    local_nonpersistent_flags+=("--help")
+    local_nonpersistent_flags+=("-h")
+    flags+=("--host=")
+    two_word_flags+=("--host")
+    two_word_flags+=("-H")
+    local_nonpersistent_flags+=("--host")
+    local_nonpersistent_flags+=("--host=")
+    local_nonpersistent_flags+=("-H")
+    flags+=("--path=")
+    two_word_flags+=("--path")
+    local_nonpersistent_flags+=("--path")
+    local_nonpersistent_flags+=("--path=")
+    flags+=("--tag=")
+    two_word_flags+=("--tag")
+    local_nonpersistent_flags+=("--tag")
+    local_nonpersistent_flags+=("--tag=")
+    flags+=("--cacert=")
+    two_word_flags+=("--cacert")
+    flags+=("--cache-dir=")
+    two_word_flags+=("--cache-dir")
+    flags+=("--cleanup-cache")
+    flags+=("--compression=")
+    two_word_flags+=("--compression")
+    flags+=("--insecure-tls")
+    flags+=("--json")
+    flags+=("--key-hint=")
+    two_word_flags+=("--key-hint")
+    flags+=("--limit-download=")
+    two_word_flags+=("--limit-download")
+    flags+=("--limit-upload=")
+    two_word_flags+=("--limit-upload")
+    flags+=("--no-cache")
+    flags+=("--no-lock")
+    flags+=("--option=")
+    two_word_flags+=("--option")
+    two_word_flags+=("-o")
+    flags+=("--pack-size=")
+    two_word_flags+=("--pack-size")
+    flags+=("--password-command=")
+    two_word_flags+=("--password-command")
+    flags+=("--password-file=")
+    two_word_flags+=("--password-file")
+    two_word_flags+=("-p")
+    flags+=("--quiet")
+    flags+=("-q")
+    flags+=("--repo=")
+    two_word_flags+=("--repo")
+    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
+    flags+=("--tls-client-cert=")
+    two_word_flags+=("--tls-client-cert")
+    flags+=("--verbose")
+    flags+=("-v")
+
+    must_have_one_flag=()
+    must_have_one_noun=()
+    noun_aliases=()
+}
+
+_restic_repair()
+{
+    last_command="restic_repair"
+
+    command_aliases=()
+
+    commands=()
+    commands+=("help")
+    commands+=("index")
+    commands+=("snapshots")
+
+    flags=()
+    two_word_flags=()
+    local_nonpersistent_flags=()
+    flags_with_completion=()
+    flags_completion=()
+
+    flags+=("--help")
+    flags+=("-h")
+    local_nonpersistent_flags+=("--help")
+    local_nonpersistent_flags+=("-h")
+    flags+=("--cacert=")
+    two_word_flags+=("--cacert")
+    flags+=("--cache-dir=")
+    two_word_flags+=("--cache-dir")
+    flags+=("--cleanup-cache")
+    flags+=("--compression=")
+    two_word_flags+=("--compression")
+    flags+=("--insecure-tls")
+    flags+=("--json")
+    flags+=("--key-hint=")
+    two_word_flags+=("--key-hint")
+    flags+=("--limit-download=")
+    two_word_flags+=("--limit-download")
+    flags+=("--limit-upload=")
+    two_word_flags+=("--limit-upload")
+    flags+=("--no-cache")
+    flags+=("--no-lock")
+    flags+=("--option=")
+    two_word_flags+=("--option")
+    two_word_flags+=("-o")
+    flags+=("--pack-size=")
+    two_word_flags+=("--pack-size")
+    flags+=("--password-command=")
+    two_word_flags+=("--password-command")
+    flags+=("--password-file=")
+    two_word_flags+=("--password-file")
+    two_word_flags+=("-p")
+    flags+=("--quiet")
+    flags+=("-q")
+    flags+=("--repo=")
+    two_word_flags+=("--repo")
+    two_word_flags+=("-r")
+    flags+=("--repository-file=")
+    two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2141,6 +2403,8 @@ _restic_restore()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2241,6 +2505,8 @@ _restic_rewrite()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2307,6 +2573,8 @@ _restic_self-update()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2397,6 +2665,8 @@ _restic_snapshots()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2477,6 +2747,8 @@ _restic_stats()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2565,6 +2837,8 @@ _restic_tag()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2629,6 +2903,8 @@ _restic_unlock()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2691,6 +2967,8 @@ _restic_version()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
@@ -2726,8 +3004,8 @@ _restic_root_command()
     commands+=("migrate")
     commands+=("mount")
     commands+=("prune")
-    commands+=("rebuild-index")
     commands+=("recover")
+    commands+=("repair")
     commands+=("restore")
     commands+=("rewrite")
     commands+=("self-update")
@@ -2781,6 +3059,8 @@ _restic_root_command()
     two_word_flags+=("-r")
     flags+=("--repository-file=")
     two_word_flags+=("--repository-file")
+    flags+=("--retry-lock=")
+    two_word_flags+=("--retry-lock")
     flags+=("--tls-client-cert=")
     two_word_flags+=("--tls-client-cert")
     flags+=("--verbose")
diff --git a/doc/fish-completion.fish b/doc/fish-completion.fish
index aa60d536d..f9d7801e1 100644
--- a/doc/fish-completion.fish
+++ b/doc/fish-completion.fish
@@ -55,6 +55,60 @@ function __restic_perform_completion
     printf "%s\n" "$directiveLine"
 end
 
+# this function limits calls to __restic_perform_completion, by caching the result behind $__restic_perform_completion_once_result
+function __restic_perform_completion_once
+    __restic_debug "Starting __restic_perform_completion_once"
+
+    if test -n "$__restic_perform_completion_once_result"
+        __restic_debug "Seems like a valid result already exists, skipping __restic_perform_completion"
+        return 0
+    end
+
+    set --global __restic_perform_completion_once_result (__restic_perform_completion)
+    if test -z "$__restic_perform_completion_once_result"
+        __restic_debug "No completions, probably due to a failure"
+        return 1
+    end
+
+    __restic_debug "Performed completions and set __restic_perform_completion_once_result"
+    return 0
+end
+
+# this function is used to clear the $__restic_perform_completion_once_result variable after completions are run
+function __restic_clear_perform_completion_once_result
+    __restic_debug ""
+    __restic_debug "========= clearing previously set __restic_perform_completion_once_result variable =========="
+    set --erase __restic_perform_completion_once_result
+    __restic_debug "Succesfully erased the variable __restic_perform_completion_once_result"
+end
+
+function __restic_requires_order_preservation
+    __restic_debug ""
+    __restic_debug "========= checking if order preservation is required =========="
+
+    __restic_perform_completion_once
+    if test -z "$__restic_perform_completion_once_result"
+        __restic_debug "Error determining if order preservation is required"
+        return 1
+    end
+
+    set -l directive (string sub --start 2 $__restic_perform_completion_once_result[-1])
+    __restic_debug "Directive is: $directive"
+
+    set -l shellCompDirectiveKeepOrder 32
+    set -l keeporder (math (math --scale 0 $directive / $shellCompDirectiveKeepOrder) % 2)
+    __restic_debug "Keeporder is: $keeporder"
+
+    if test $keeporder -ne 0
+        __restic_debug "This does require order preservation"
+        return 0
+    end
+
+    __restic_debug "This doesn't require order preservation"
+    return 1
+end
+
+
 # This function does two things:
 # - Obtain the completions and store them in the global __restic_comp_results
 # - Return false if file completion should be performed
@@ -65,17 +119,17 @@ function __restic_prepare_completions
     # Start fresh
     set --erase __restic_comp_results
 
-    set -l results (__restic_perform_completion)
-    __restic_debug "Completion results: $results"
+    __restic_perform_completion_once
+    __restic_debug "Completion results: $__restic_perform_completion_once_result"
 
-    if test -z "$results"
+    if test -z "$__restic_perform_completion_once_result"
         __restic_debug "No completion, probably due to a failure"
         # Might as well do file completion, in case it helps
         return 1
     end
 
-    set -l directive (string sub --start 2 $results[-1])
-    set --global __restic_comp_results $results[1..-2]
+    set -l directive (string sub --start 2 $__restic_perform_completion_once_result[-1])
+    set --global __restic_comp_results $__restic_perform_completion_once_result[1..-2]
 
     __restic_debug "Completions are: $__restic_comp_results"
     __restic_debug "Directive is: $directive"
@@ -171,7 +225,11 @@ end
 # Remove any pre-existing completions for the program since we will be handling all of them.
 complete -c restic -e
 
+# this will get called after the two calls below and clear the $__restic_perform_completion_once_result global
+complete -c restic -n '__restic_clear_perform_completion_once_result'
 # The call to __restic_prepare_completions will setup __restic_comp_results
 # which provides the program's completion choices.
-complete -c restic -n '__restic_prepare_completions' -f -a '$__restic_comp_results'
-
+# If this doesn't require order preservation, we don't use the -k flag
+complete -c restic -n 'not __restic_requires_order_preservation && __restic_prepare_completions' -f -a '$__restic_comp_results'
+# otherwise we use the -k flag
+complete -k -c restic -n '__restic_requires_order_preservation && __restic_prepare_completions' -f -a '$__restic_comp_results'
diff --git a/doc/man/restic-backup.1 b/doc/man/restic-backup.1
index 4297c3b8e..a07d19434 100644
--- a/doc/man/restic-backup.1
+++ b/doc/man/restic-backup.1
@@ -65,6 +65,10 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 \fB-f\fP, \fB--force\fP[=false]
 	force re-reading the target files/directories (overrides the "parent" flag)
 
+.PP
+\fB-g\fP, \fB--group-by\fP=host,paths
+	\fB\fCgroup\fR snapshots by host, paths and/or tags, separated by comma (disable grouping with '')
+
 .PP
 \fB-h\fP, \fB--help\fP[=false]
 	help for backup
@@ -99,7 +103,7 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--parent\fP=""
-	use this parent \fB\fCsnapshot\fR (default: last snapshot in the repository that has the same target files/directories, and is not newer than the snapshot time)
+	use this parent \fB\fCsnapshot\fR (default: latest snapshot in the group determined by --group-by and not newer than the timestamp determined by --time)
 
 .PP
 \fB--read-concurrency\fP=0
@@ -129,7 +133,7 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -141,7 +145,7 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -199,9 +203,13 @@ Exit status is 3 if some source data could not be read (incomplete snapshot crea
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-cache.1 b/doc/man/restic-cache.1
index 3552fb1dc..a6ae75e31 100644
--- a/doc/man/restic-cache.1
+++ b/doc/man/restic-cache.1
@@ -42,7 +42,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -54,7 +54,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -112,9 +112,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-cat.1 b/doc/man/restic-cat.1
index 2e787fa06..08170582d 100644
--- a/doc/man/restic-cat.1
+++ b/doc/man/restic-cat.1
@@ -8,7 +8,7 @@ restic-cat - Print internal objects to stdout
 
 .SH SYNOPSIS
 .PP
-\fBrestic cat [flags] [pack|blob|snapshot|index|key|masterkey|config|lock] ID\fP
+\fBrestic cat [flags] [masterkey|config|pack ID|blob ID|snapshot ID|index ID|key ID|lock ID|tree snapshot:subfolder]\fP
 
 
 .SH DESCRIPTION
@@ -30,7 +30,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -42,7 +42,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -100,9 +100,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-check.1 b/doc/man/restic-check.1
index e641fc2b5..0f7a594cd 100644
--- a/doc/man/restic-check.1
+++ b/doc/man/restic-check.1
@@ -41,13 +41,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--with-cache\fP[=false]
-	use the cache
+	use existing cache, only read uncached data from repository
 
 
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -59,7 +59,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -117,9 +117,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-copy.1 b/doc/man/restic-copy.1
index 53badecc9..1dbfae0f3 100644
--- a/doc/man/restic-copy.1
+++ b/doc/man/restic-copy.1
@@ -71,7 +71,7 @@ new destination repository using the "init" command.
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -83,7 +83,7 @@ new destination repository using the "init" command.
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -141,9 +141,13 @@ new destination repository using the "init" command.
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-diff.1 b/doc/man/restic-diff.1
index 31c34dc8a..15f7c6b9f 100644
--- a/doc/man/restic-diff.1
+++ b/doc/man/restic-diff.1
@@ -50,7 +50,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -62,7 +62,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -120,9 +120,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-dump.1 b/doc/man/restic-dump.1
index 61b3b3ec8..d06800e4b 100644
--- a/doc/man/restic-dump.1
+++ b/doc/man/restic-dump.1
@@ -53,7 +53,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -65,7 +65,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -123,9 +123,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-find.1 b/doc/man/restic-find.1
index 9fa4dd811..5038a72e7 100644
--- a/doc/man/restic-find.1
+++ b/doc/man/restic-find.1
@@ -31,6 +31,10 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 \fB-H\fP, \fB--host\fP=[]
 	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
 
+.PP
+\fB--human-readable\fP[=false]
+	print sizes in human readable format
+
 .PP
 \fB-i\fP, \fB--ignore-case\fP[=false]
 	ignore case for pattern
@@ -75,7 +79,7 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -87,7 +91,7 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -145,9 +149,13 @@ It can also be used to search for restic blobs or trees for troubleshooting.
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-forget.1 b/doc/man/restic-forget.1
index d8a69856e..6920d1bba 100644
--- a/doc/man/restic-forget.1
+++ b/doc/man/restic-forget.1
@@ -35,27 +35,27 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB-l\fP, \fB--keep-last\fP=0
-	keep the last \fB\fCn\fR snapshots
+	keep the last \fB\fCn\fR snapshots (use 'unlimited' to keep all snapshots)
 
 .PP
 \fB-H\fP, \fB--keep-hourly\fP=0
-	keep the last \fB\fCn\fR hourly snapshots
+	keep the last \fB\fCn\fR hourly snapshots (use 'unlimited' to keep all hourly snapshots)
 
 .PP
 \fB-d\fP, \fB--keep-daily\fP=0
-	keep the last \fB\fCn\fR daily snapshots
+	keep the last \fB\fCn\fR daily snapshots (use 'unlimited' to keep all daily snapshots)
 
 .PP
 \fB-w\fP, \fB--keep-weekly\fP=0
-	keep the last \fB\fCn\fR weekly snapshots
+	keep the last \fB\fCn\fR weekly snapshots (use 'unlimited' to keep all weekly snapshots)
 
 .PP
 \fB-m\fP, \fB--keep-monthly\fP=0
-	keep the last \fB\fCn\fR monthly snapshots
+	keep the last \fB\fCn\fR monthly snapshots (use 'unlimited' to keep all monthly snapshots)
 
 .PP
 \fB-y\fP, \fB--keep-yearly\fP=0
-	keep the last \fB\fCn\fR yearly snapshots
+	keep the last \fB\fCn\fR yearly snapshots (use 'unlimited' to keep all yearly snapshots)
 
 .PP
 \fB--keep-within\fP=
@@ -102,7 +102,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 	use compact output format
 
 .PP
-\fB-g\fP, \fB--group-by\fP="host,paths"
+\fB-g\fP, \fB--group-by\fP=host,paths
 	\fB\fCgroup\fR snapshots by host, paths and/or tags, separated by comma (disable grouping with '')
 
 .PP
@@ -141,7 +141,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -153,7 +153,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -211,9 +211,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-generate.1 b/doc/man/restic-generate.1
index 6b54ebfca..a557ebd9a 100644
--- a/doc/man/restic-generate.1
+++ b/doc/man/restic-generate.1
@@ -51,7 +51,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -63,7 +63,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -121,9 +121,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-init.1 b/doc/man/restic-init.1
index 194f31756..7916b6162 100644
--- a/doc/man/restic-init.1
+++ b/doc/man/restic-init.1
@@ -58,7 +58,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -70,7 +70,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -128,9 +128,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-key.1 b/doc/man/restic-key.1
index 4163cefa5..a5e7a5421 100644
--- a/doc/man/restic-key.1
+++ b/doc/man/restic-key.1
@@ -42,7 +42,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -54,7 +54,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -112,9 +112,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-list.1 b/doc/man/restic-list.1
index 6683e2c47..48ca94274 100644
--- a/doc/man/restic-list.1
+++ b/doc/man/restic-list.1
@@ -30,7 +30,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -42,7 +42,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -100,9 +100,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-ls.1 b/doc/man/restic-ls.1
index a16716434..1df321132 100644
--- a/doc/man/restic-ls.1
+++ b/doc/man/restic-ls.1
@@ -45,6 +45,10 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB-H\fP, \fB--host\fP=[]
 	only consider snapshots for this \fB\fChost\fR, when snapshot ID "latest" is given (can be specified multiple times)
 
+.PP
+\fB--human-readable\fP[=false]
+	print sizes in human readable format
+
 .PP
 \fB-l\fP, \fB--long\fP[=false]
 	use a long listing format showing size and mode
@@ -65,7 +69,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -77,7 +81,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -135,9 +139,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-migrate.1 b/doc/man/restic-migrate.1
index d8127090e..63aa784ea 100644
--- a/doc/man/restic-migrate.1
+++ b/doc/man/restic-migrate.1
@@ -36,7 +36,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -48,7 +48,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -106,9 +106,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-mount.1 b/doc/man/restic-mount.1
index ce4f893a7..a6ffa2d67 100644
--- a/doc/man/restic-mount.1
+++ b/doc/man/restic-mount.1
@@ -114,7 +114,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -126,7 +126,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -184,9 +184,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-prune.1 b/doc/man/restic-prune.1
index 197cb1130..7f01a1e8f 100644
--- a/doc/man/restic-prune.1
+++ b/doc/man/restic-prune.1
@@ -59,7 +59,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -71,7 +71,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -129,9 +129,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-recover.1 b/doc/man/restic-recover.1
index aa3441156..4e9e1c92f 100644
--- a/doc/man/restic-recover.1
+++ b/doc/man/restic-recover.1
@@ -32,7 +32,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -44,7 +44,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -102,9 +102,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-rebuild-index.1 b/doc/man/restic-repair-index.1
similarity index 84%
rename from doc/man/restic-rebuild-index.1
rename to doc/man/restic-repair-index.1
index 18878b66f..773f44a42 100644
--- a/doc/man/restic-rebuild-index.1
+++ b/doc/man/restic-repair-index.1
@@ -3,17 +3,17 @@
 
 .SH NAME
 .PP
-restic-rebuild-index - Build a new index
+restic-repair-index - Build a new index
 
 
 .SH SYNOPSIS
 .PP
-\fBrestic rebuild-index [flags]\fP
+\fBrestic repair index [flags]\fP
 
 
 .SH DESCRIPTION
 .PP
-The "rebuild-index" command creates a new index based on the pack files in the
+The "repair index" command creates a new index based on the pack files in the
 repository.
 
 
@@ -25,7 +25,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS
 .PP
 \fB-h\fP, \fB--help\fP[=false]
-	help for rebuild-index
+	help for index
 
 .PP
 \fB--read-all-packs\fP[=false]
@@ -35,7 +35,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -47,7 +47,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -105,9 +105,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
@@ -116,4 +120,4 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .SH SEE ALSO
 .PP
-\fBrestic(1)\fP
+\fBrestic-repair(1)\fP
diff --git a/doc/man/restic-repair-snapshots.1 b/doc/man/restic-repair-snapshots.1
new file mode 100644
index 000000000..45acf8e7b
--- /dev/null
+++ b/doc/man/restic-repair-snapshots.1
@@ -0,0 +1,157 @@
+.nh
+.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+
+.SH NAME
+.PP
+restic-repair-snapshots - Repair snapshots
+
+
+.SH SYNOPSIS
+.PP
+\fBrestic repair snapshots [flags] [snapshot ID] [...]\fP
+
+
+.SH DESCRIPTION
+.PP
+The "repair snapshots" command repairs broken snapshots. It scans the given
+snapshots and generates new ones with damaged directories and file contents
+removed. If the broken snapshots are deleted, a prune run will be able to
+clean up the repository.
+
+.PP
+The command depends on a correct index, thus make sure to run "repair index"
+first!
+
+
+.SH WARNING
+.PP
+Repairing and deleting broken snapshots causes data loss! It will remove broken
+directories and modify broken files in the modified snapshots.
+
+.PP
+If the contents of directories and files are still available, the better option
+is to run "backup" which in that case is able to heal existing snapshots. Only
+use the "repair snapshots" command if you need to recover an old and broken
+snapshot!
+
+
+.SH EXIT STATUS
+.PP
+Exit status is 0 if the command was successful, and non-zero if there was any error.
+
+
+.SH OPTIONS
+.PP
+\fB-n\fP, \fB--dry-run\fP[=false]
+	do not do anything, just print what would be done
+
+.PP
+\fB--forget\fP[=false]
+	remove original snapshots after creating new ones
+
+.PP
+\fB-h\fP, \fB--help\fP[=false]
+	help for snapshots
+
+.PP
+\fB-H\fP, \fB--host\fP=[]
+	only consider snapshots for this \fB\fChost\fR (can be specified multiple times)
+
+.PP
+\fB--path\fP=[]
+	only consider snapshots including this (absolute) \fB\fCpath\fR (can be specified multiple times)
+
+.PP
+\fB--tag\fP=[]
+	only consider snapshots including \fB\fCtag[,tag,...]\fR (can be specified multiple times)
+
+
+.SH OPTIONS INHERITED FROM PARENT COMMANDS
+.PP
+\fB--cacert\fP=[]
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+
+.PP
+\fB--cache-dir\fP=""
+	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+
+.PP
+\fB--cleanup-cache\fP[=false]
+	auto remove old cache directories
+
+.PP
+\fB--compression\fP=auto
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
+
+.PP
+\fB--insecure-tls\fP[=false]
+	skip TLS certificate verification when connecting to the repository (insecure)
+
+.PP
+\fB--json\fP[=false]
+	set output mode to JSON for commands that support it
+
+.PP
+\fB--key-hint\fP=""
+	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+
+.PP
+\fB--limit-download\fP=0
+	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+
+.PP
+\fB--limit-upload\fP=0
+	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+
+.PP
+\fB--no-cache\fP[=false]
+	do not use a local cache
+
+.PP
+\fB--no-lock\fP[=false]
+	do not lock the repository, this allows some operations on read-only repositories
+
+.PP
+\fB-o\fP, \fB--option\fP=[]
+	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+
+.PP
+\fB--pack-size\fP=0
+	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+
+.PP
+\fB--password-command\fP=""
+	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+
+.PP
+\fB-p\fP, \fB--password-file\fP=""
+	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+
+.PP
+\fB-q\fP, \fB--quiet\fP[=false]
+	do not output comprehensive progress report
+
+.PP
+\fB-r\fP, \fB--repo\fP=""
+	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+
+.PP
+\fB--repository-file\fP=""
+	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
+.PP
+\fB--tls-client-cert\fP=""
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+
+.PP
+\fB-v\fP, \fB--verbose\fP[=0]
+	be verbose (specify multiple times or a level using --verbose=n``, max level/times is 2)
+
+
+.SH SEE ALSO
+.PP
+\fBrestic-repair(1)\fP
diff --git a/doc/man/restic-repair.1 b/doc/man/restic-repair.1
new file mode 100644
index 000000000..e1e0520c6
--- /dev/null
+++ b/doc/man/restic-repair.1
@@ -0,0 +1,113 @@
+.nh
+.TH "restic backup" "1" "Jan 2017" "generated by \fB\fCrestic generate\fR" ""
+
+.SH NAME
+.PP
+restic-repair - Repair the repository
+
+
+.SH SYNOPSIS
+.PP
+\fBrestic repair [flags]\fP
+
+
+.SH DESCRIPTION
+.PP
+Repair the repository
+
+
+.SH OPTIONS
+.PP
+\fB-h\fP, \fB--help\fP[=false]
+	help for repair
+
+
+.SH OPTIONS INHERITED FROM PARENT COMMANDS
+.PP
+\fB--cacert\fP=[]
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
+
+.PP
+\fB--cache-dir\fP=""
+	set the cache \fB\fCdirectory\fR\&. (default: use system default cache directory)
+
+.PP
+\fB--cleanup-cache\fP[=false]
+	auto remove old cache directories
+
+.PP
+\fB--compression\fP=auto
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
+
+.PP
+\fB--insecure-tls\fP[=false]
+	skip TLS certificate verification when connecting to the repository (insecure)
+
+.PP
+\fB--json\fP[=false]
+	set output mode to JSON for commands that support it
+
+.PP
+\fB--key-hint\fP=""
+	\fB\fCkey\fR ID of key to try decrypting first (default: $RESTIC_KEY_HINT)
+
+.PP
+\fB--limit-download\fP=0
+	limits downloads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+
+.PP
+\fB--limit-upload\fP=0
+	limits uploads to a maximum \fB\fCrate\fR in KiB/s. (default: unlimited)
+
+.PP
+\fB--no-cache\fP[=false]
+	do not use a local cache
+
+.PP
+\fB--no-lock\fP[=false]
+	do not lock the repository, this allows some operations on read-only repositories
+
+.PP
+\fB-o\fP, \fB--option\fP=[]
+	set extended option (\fB\fCkey=value\fR, can be specified multiple times)
+
+.PP
+\fB--pack-size\fP=0
+	set target pack \fB\fCsize\fR in MiB, created pack files may be larger (default: $RESTIC_PACK_SIZE)
+
+.PP
+\fB--password-command\fP=""
+	shell \fB\fCcommand\fR to obtain the repository password from (default: $RESTIC_PASSWORD_COMMAND)
+
+.PP
+\fB-p\fP, \fB--password-file\fP=""
+	\fB\fCfile\fR to read the repository password from (default: $RESTIC_PASSWORD_FILE)
+
+.PP
+\fB-q\fP, \fB--quiet\fP[=false]
+	do not output comprehensive progress report
+
+.PP
+\fB-r\fP, \fB--repo\fP=""
+	\fB\fCrepository\fR to backup to or restore from (default: $RESTIC_REPOSITORY)
+
+.PP
+\fB--repository-file\fP=""
+	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
+
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
+.PP
+\fB--tls-client-cert\fP=""
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
+
+.PP
+\fB-v\fP, \fB--verbose\fP[=0]
+	be verbose (specify multiple times or a level using --verbose=n``, max level/times is 2)
+
+
+.SH SEE ALSO
+.PP
+\fBrestic(1)\fP, \fBrestic-repair-index(1)\fP, \fBrestic-repair-snapshots(1)\fP
diff --git a/doc/man/restic-restore.1 b/doc/man/restic-restore.1
index 39ff62059..6abc8d5aa 100644
--- a/doc/man/restic-restore.1
+++ b/doc/man/restic-restore.1
@@ -75,7 +75,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -87,7 +87,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -145,9 +145,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-rewrite.1 b/doc/man/restic-rewrite.1
index 6edf51b95..30960e577 100644
--- a/doc/man/restic-rewrite.1
+++ b/doc/man/restic-rewrite.1
@@ -83,7 +83,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -95,7 +95,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -153,9 +153,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-self-update.1 b/doc/man/restic-self-update.1
index e311b2277..c981b93fe 100644
--- a/doc/man/restic-self-update.1
+++ b/doc/man/restic-self-update.1
@@ -37,7 +37,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -49,7 +49,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -107,9 +107,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-snapshots.1 b/doc/man/restic-snapshots.1
index d2dbf52ee..9770e42ef 100644
--- a/doc/man/restic-snapshots.1
+++ b/doc/man/restic-snapshots.1
@@ -27,7 +27,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 	use compact output format
 
 .PP
-\fB-g\fP, \fB--group-by\fP=""
+\fB-g\fP, \fB--group-by\fP=
 	\fB\fCgroup\fR snapshots by host, paths and/or tags, separated by comma
 
 .PP
@@ -54,7 +54,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -66,7 +66,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -124,9 +124,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-stats.1 b/doc/man/restic-stats.1
index 694bde22d..78b8c94df 100644
--- a/doc/man/restic-stats.1
+++ b/doc/man/restic-stats.1
@@ -76,7 +76,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -88,7 +88,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -146,9 +146,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-tag.1 b/doc/man/restic-tag.1
index 1ff0b4f78..c5cf273b8 100644
--- a/doc/man/restic-tag.1
+++ b/doc/man/restic-tag.1
@@ -61,7 +61,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -73,7 +73,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -131,9 +131,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-unlock.1 b/doc/man/restic-unlock.1
index e5b408915..3823e747f 100644
--- a/doc/man/restic-unlock.1
+++ b/doc/man/restic-unlock.1
@@ -34,7 +34,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -46,7 +46,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -104,9 +104,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic-version.1 b/doc/man/restic-version.1
index eca34d60a..db83e6162 100644
--- a/doc/man/restic-version.1
+++ b/doc/man/restic-version.1
@@ -31,7 +31,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 .SH OPTIONS INHERITED FROM PARENT COMMANDS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -43,7 +43,7 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB--insecure-tls\fP[=false]
@@ -101,9 +101,13 @@ Exit status is 0 if the command was successful, and non-zero if there was any er
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
diff --git a/doc/man/restic.1 b/doc/man/restic.1
index f76d16e38..9a96533fc 100644
--- a/doc/man/restic.1
+++ b/doc/man/restic.1
@@ -16,11 +16,14 @@ restic - Backup and restore files
 restic is a backup program which allows saving multiple revisions of files and
 directories in an encrypted repository stored on different backends.
 
+.PP
+The full documentation can be found at https://restic.readthedocs.io/ .
+
 
 .SH OPTIONS
 .PP
 \fB--cacert\fP=[]
-	\fB\fCfile\fR to load root certificates from (default: use system certificates)
+	\fB\fCfile\fR to load root certificates from (default: use system certificates or $RESTIC_CACERT)
 
 .PP
 \fB--cache-dir\fP=""
@@ -32,7 +35,7 @@ directories in an encrypted repository stored on different backends.
 
 .PP
 \fB--compression\fP=auto
-	compression mode (only available for repository format version 2), one of (auto|off|max)
+	compression mode (only available for repository format version 2), one of (auto|off|max) (default: $RESTIC_COMPRESSION)
 
 .PP
 \fB-h\fP, \fB--help\fP[=false]
@@ -94,9 +97,13 @@ directories in an encrypted repository stored on different backends.
 \fB--repository-file\fP=""
 	\fB\fCfile\fR to read the repository location from (default: $RESTIC_REPOSITORY_FILE)
 
+.PP
+\fB--retry-lock\fP=0s
+	retry to lock the repository if it is already locked, takes a value like 5m or 2h (default: no retries)
+
 .PP
 \fB--tls-client-cert\fP=""
-	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key
+	path to a \fB\fCfile\fR containing PEM encoded TLS client certificate and private key (default: $RESTIC_TLS_CLIENT_CERT)
 
 .PP
 \fB-v\fP, \fB--verbose\fP[=0]
@@ -105,4 +112,4 @@ directories in an encrypted repository stored on different backends.
 
 .SH SEE ALSO
 .PP
-\fBrestic-backup(1)\fP, \fBrestic-cache(1)\fP, \fBrestic-cat(1)\fP, \fBrestic-check(1)\fP, \fBrestic-copy(1)\fP, \fBrestic-diff(1)\fP, \fBrestic-dump(1)\fP, \fBrestic-find(1)\fP, \fBrestic-forget(1)\fP, \fBrestic-generate(1)\fP, \fBrestic-init(1)\fP, \fBrestic-key(1)\fP, \fBrestic-list(1)\fP, \fBrestic-ls(1)\fP, \fBrestic-migrate(1)\fP, \fBrestic-mount(1)\fP, \fBrestic-prune(1)\fP, \fBrestic-rebuild-index(1)\fP, \fBrestic-recover(1)\fP, \fBrestic-restore(1)\fP, \fBrestic-rewrite(1)\fP, \fBrestic-self-update(1)\fP, \fBrestic-snapshots(1)\fP, \fBrestic-stats(1)\fP, \fBrestic-tag(1)\fP, \fBrestic-unlock(1)\fP, \fBrestic-version(1)\fP
+\fBrestic-backup(1)\fP, \fBrestic-cache(1)\fP, \fBrestic-cat(1)\fP, \fBrestic-check(1)\fP, \fBrestic-copy(1)\fP, \fBrestic-diff(1)\fP, \fBrestic-dump(1)\fP, \fBrestic-find(1)\fP, \fBrestic-forget(1)\fP, \fBrestic-generate(1)\fP, \fBrestic-init(1)\fP, \fBrestic-key(1)\fP, \fBrestic-list(1)\fP, \fBrestic-ls(1)\fP, \fBrestic-migrate(1)\fP, \fBrestic-mount(1)\fP, \fBrestic-prune(1)\fP, \fBrestic-recover(1)\fP, \fBrestic-repair(1)\fP, \fBrestic-restore(1)\fP, \fBrestic-rewrite(1)\fP, \fBrestic-self-update(1)\fP, \fBrestic-snapshots(1)\fP, \fBrestic-stats(1)\fP, \fBrestic-tag(1)\fP, \fBrestic-unlock(1)\fP, \fBrestic-version(1)\fP
diff --git a/doc/powershell-completion.ps1 b/doc/powershell-completion.ps1
index 271809161..d8aa5a1af 100644
--- a/doc/powershell-completion.ps1
+++ b/doc/powershell-completion.ps1
@@ -40,6 +40,7 @@ filter __restic_escapeStringWithSpecialChars {
     $ShellCompDirectiveNoFileComp=4
     $ShellCompDirectiveFilterFileExt=8
     $ShellCompDirectiveFilterDirs=16
+    $ShellCompDirectiveKeepOrder=32
 
     # Prepare the command to request completions for the program.
     # Split the command at the first space to separate the program and arguments.
@@ -69,8 +70,17 @@ filter __restic_escapeStringWithSpecialChars {
         # If the last parameter is complete (there is a space following it)
         # We add an extra empty parameter so we can indicate this to the go method.
         __restic_debug "Adding extra empty parameter"
-        # We need to use `"`" to pass an empty argument a "" or '' does not work!!!
-        $RequestComp="$RequestComp" + ' `"`"'
+        # PowerShell 7.2+ changed the way how the arguments are passed to executables,
+        # so for pre-7.2 or when Legacy argument passing is enabled we need to use
+        # `"`" to pass an empty argument, a "" or '' does not work!!!
+        if ($PSVersionTable.PsVersion -lt [version]'7.2.0' -or
+            ($PSVersionTable.PsVersion -lt [version]'7.3.0' -and -not [ExperimentalFeature]::IsEnabled("PSNativeCommandArgumentPassing")) -or
+            (($PSVersionTable.PsVersion -ge [version]'7.3.0' -or [ExperimentalFeature]::IsEnabled("PSNativeCommandArgumentPassing")) -and
+              $PSNativeCommandArgumentPassing -eq 'Legacy')) {
+             $RequestComp="$RequestComp" + ' `"`"'
+        } else {
+             $RequestComp="$RequestComp" + ' ""'
+        }
     }
 
     __restic_debug "Calling $RequestComp"
@@ -100,7 +110,7 @@ filter __restic_escapeStringWithSpecialChars {
     }
 
     $Longest = 0
-    $Values = $Out | ForEach-Object {
+    [Array]$Values = $Out | ForEach-Object {
         #Split the output in name and description
         $Name, $Description = $_.Split("`t",2)
         __restic_debug "Name: $Name Description: $Description"
@@ -145,6 +155,11 @@ filter __restic_escapeStringWithSpecialChars {
         }
     }
 
+    # we sort the values in ascending order by name if keep order isn't passed
+    if (($Directive -band $ShellCompDirectiveKeepOrder) -eq 0 ) {
+        $Values = $Values | Sort-Object -Property Name
+    }
+
     if (($Directive -band $ShellCompDirectiveNoFileComp) -ne 0 ) {
         __restic_debug "ShellCompDirectiveNoFileComp is called"
 
diff --git a/doc/zsh-completion.zsh b/doc/zsh-completion.zsh
index cea6abb38..ec1c52a00 100644
--- a/doc/zsh-completion.zsh
+++ b/doc/zsh-completion.zsh
@@ -1,4 +1,5 @@
 #compdef restic
+compdef _restic restic
 
 # zsh completion for restic                               -*- shell-script -*-
 
@@ -17,8 +18,9 @@ _restic()
     local shellCompDirectiveNoFileComp=4
     local shellCompDirectiveFilterFileExt=8
     local shellCompDirectiveFilterDirs=16
+    local shellCompDirectiveKeepOrder=32
 
-    local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace
+    local lastParam lastChar flagPrefix requestComp out directive comp lastComp noSpace keepOrder
     local -a completions
 
     __restic_debug "\n========= starting completion logic =========="
@@ -136,6 +138,11 @@ _restic()
         noSpace="-S ''"
     fi
 
+    if [ $((directive & shellCompDirectiveKeepOrder)) -ne 0 ]; then
+        __restic_debug "Activating keep order."
+        keepOrder="-V"
+    fi
+
     if [ $((directive & shellCompDirectiveFilterFileExt)) -ne 0 ]; then
         # File extension filtering
         local filteringCmd
@@ -171,7 +178,7 @@ _restic()
         return $result
     else
         __restic_debug "Calling _describe"
-        if eval _describe "completions" completions $flagPrefix $noSpace; then
+        if eval _describe $keepOrder "completions" completions $flagPrefix $noSpace; then
             __restic_debug "_describe found some completions"
 
             # Return the success of having called _describe