diff --git a/internal/backend/local/local.go b/internal/backend/local/local.go
index 2a48230fc..4930264fd 100644
--- a/internal/backend/local/local.go
+++ b/internal/backend/local/local.go
@@ -13,6 +13,8 @@ import (
 	"github.com/restic/restic/internal/backend"
 	"github.com/restic/restic/internal/debug"
 	"github.com/restic/restic/internal/fs"
+
+	"github.com/cenkalti/backoff/v4"
 )
 
 // Local is a backend in a local directory.
@@ -80,7 +82,7 @@ func (b *Local) IsNotExist(err error) bool {
 }
 
 // Save stores data in the backend at the handle.
-func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReader) error {
+func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReader) (err error) {
 	debug.Log("Save %v", h)
 	if err := h.Valid(); err != nil {
 		return err
@@ -88,8 +90,16 @@ func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReade
 
 	filename := b.Filename(h)
 
+	defer func() {
+		// Mark non-retriable errors as such (currently only
+		// "no space left on device").
+		if errors.Is(err, syscall.ENOSPC) {
+			err = backoff.Permanent(err)
+		}
+	}()
+
 	// create new file
-	f, err := fs.OpenFile(filename, os.O_CREATE|os.O_EXCL|os.O_WRONLY, backend.Modes.File)
+	f, err := openFile(filename, os.O_CREATE|os.O_EXCL|os.O_WRONLY, backend.Modes.File)
 
 	if b.IsNotExist(err) {
 		debug.Log("error %v: creating dir", err)
@@ -100,7 +110,7 @@ func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReade
 			debug.Log("error creating dir %v: %v", filepath.Dir(filename), mkdirErr)
 		} else {
 			// try again
-			f, err = fs.OpenFile(filename, os.O_CREATE|os.O_EXCL|os.O_WRONLY, backend.Modes.File)
+			f, err = openFile(filename, os.O_CREATE|os.O_EXCL|os.O_WRONLY, backend.Modes.File)
 		}
 	}
 
@@ -141,6 +151,8 @@ func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReade
 	return nil
 }
 
+var openFile = fs.OpenFile // Overridden by test.
+
 // Load runs fn with a reader that yields the contents of the file at h at the
 // given offset.
 func (b *Local) Load(ctx context.Context, h restic.Handle, length int, offset int64, fn func(rd io.Reader) error) error {
diff --git a/internal/backend/local/local_internal_test.go b/internal/backend/local/local_internal_test.go
new file mode 100644
index 000000000..a67233903
--- /dev/null
+++ b/internal/backend/local/local_internal_test.go
@@ -0,0 +1,42 @@
+package local
+
+import (
+	"context"
+	"errors"
+	"os"
+	"syscall"
+	"testing"
+
+	"github.com/restic/restic/internal/restic"
+	rtest "github.com/restic/restic/internal/test"
+
+	"github.com/cenkalti/backoff/v4"
+)
+
+func TestNoSpacePermanent(t *testing.T) {
+	oldOpenFile := openFile
+	defer func() {
+		openFile = oldOpenFile
+	}()
+
+	openFile = func(name string, flags int, mode os.FileMode) (*os.File, error) {
+		// The actual error from os.OpenFile is *os.PathError.
+		// Other functions called inside Save may return *os.SyscallError.
+		return nil, os.NewSyscallError("open", syscall.ENOSPC)
+	}
+
+	dir, cleanup := rtest.TempDir(t)
+	defer cleanup()
+
+	be, err := Open(context.Background(), Config{Path: dir})
+	rtest.OK(t, err)
+	defer be.Close()
+
+	h := restic.Handle{Type: restic.ConfigFile}
+	err = be.Save(context.Background(), h, nil)
+	_, ok := err.(*backoff.PermanentError)
+	rtest.Assert(t, ok,
+		"error type should be backoff.PermanentError, got %T", err)
+	rtest.Assert(t, errors.Is(err, syscall.ENOSPC),
+		"could not recover original ENOSPC error")
+}
diff --git a/internal/errors/errors.go b/internal/errors/errors.go
index ffd3d615e..51a425299 100644
--- a/internal/errors/errors.go
+++ b/internal/errors/errors.go
@@ -3,6 +3,7 @@ package errors
 import (
 	"net/url"
 
+	"github.com/cenkalti/backoff/v4"
 	"github.com/pkg/errors"
 )
 
@@ -34,20 +35,19 @@ func Cause(err error) error {
 	}
 
 	for {
-		// unwrap *url.Error
-		if urlErr, ok := err.(*url.Error); ok {
-			err = urlErr.Err
-			continue
+		switch e := err.(type) {
+		case Causer: // github.com/pkg/errors
+			err = e.Cause()
+		case *backoff.PermanentError:
+			err = e.Err
+		case *url.Error:
+			err = e.Err
+		default:
+			return err
 		}
-
-		// if err is a Causer, return the cause for this error.
-		if c, ok := err.(Causer); ok {
-			err = c.Cause()
-			continue
-		}
-
-		break
 	}
-
-	return err
 }
+
+// Go 1.13-style error handling.
+
+func Is(x, y error) bool { return errors.Is(x, y) }
diff --git a/internal/restic/backend.go b/internal/restic/backend.go
index b2fd46b97..cda5c30c7 100644
--- a/internal/restic/backend.go
+++ b/internal/restic/backend.go
@@ -6,6 +6,12 @@ import (
 )
 
 // Backend is used to store and access data.
+//
+// Backend operations that return an error will be retried when a Backend is
+// wrapped in a RetryBackend. To prevent that from happening, the operations
+// should return a github.com/cenkalti/backoff/v4.PermanentError. Errors from
+// the context package need not be wrapped, as context cancellation is checked
+// separately by the retrying logic.
 type Backend interface {
 	// Location returns a string that describes the type and location of the
 	// repository.