diff --git a/kubernetes/infrastructure/netbird-backup/cronjob.yaml b/kubernetes/infrastructure/netbird-backup/cronjob.yaml
index d7037599..17a07c54 100644
--- a/kubernetes/infrastructure/netbird-backup/cronjob.yaml
+++ b/kubernetes/infrastructure/netbird-backup/cronjob.yaml
@@ -49,6 +49,9 @@ spec:
                   # readable, so copy first. Known-hosts is TOFU on first
                   # run, then pinned on the PVC.
                   install -m 600 /ssh/ssh-key /tmp/key
+                  # Leftover .part files from aborted earlier runs are
+                  # outside the retention glob — clear them up front.
+                  rm -f /backup/*.part
                   ts=$(date +%Y-%m-%d)
                   ssh -i /tmp/key \
                       -o StrictHostKeyChecking=accept-new \
diff --git a/kubernetes/infrastructure/netbird-backup/pvc.yaml b/kubernetes/infrastructure/netbird-backup/pvc.yaml
index 626edb2f..d8b2f600 100644
--- a/kubernetes/infrastructure/netbird-backup/pvc.yaml
+++ b/kubernetes/infrastructure/netbird-backup/pvc.yaml
@@ -4,8 +4,9 @@ metadata:
   name: netbird-backup
   namespace: netbird-backup
 spec:
-  # ceph-block (cluster default). 14 daily dumps of a small SQLite store
-  # plus config — 5Gi is generous headroom.
+  # 14 daily dumps of a small SQLite store plus config — 5Gi is
+  # generous headroom.
+  storageClassName: ceph-block
   accessModes:
     - ReadWriteOnce
   resources:
diff --git a/kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml b/kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml
index 1a0243d4..b850a7b3 100644
--- a/kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml
+++ b/kubernetes/infrastructure/post-crds/openbao-clustersecretstore.yaml
@@ -26,6 +26,7 @@ spec:
         - influxdb
         - ingress
         - monitoring
+        - netbird-backup # netbird-backup-ssh: the VPS-pull backup key
         - paperless
         - velero
   provider: