diff --git a/kubernetes/clusters/1276-prod/garage/garage/service.yaml b/kubernetes/clusters/1276-prod/garage/garage/service.yaml
index c581883a..56005b5a 100644
--- a/kubernetes/clusters/1276-prod/garage/garage/service.yaml
+++ b/kubernetes/clusters/1276-prod/garage/garage/service.yaml
@@ -28,3 +28,20 @@ spec:
   selector: { app.kubernetes.io/name: garage }
   ports:
     - { name: rpc, port: 3901, targetPort: 3901 }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-s3-lb
+  namespace: garage
+  annotations:
+    # internal external-dns (RFC2136 -> Technitium) only processes resources
+    # carrying this provider annotation (--annotation-filter). Without it the
+    # A record for garage.kian.sh is never published. Mirrors pelican-internal.
+    dns.kian.sh/provider: internal
+    external-dns.alpha.kubernetes.io/hostname: garage.kian.sh
+spec:
+  type: LoadBalancer         # MetalLB IP, reachable from VLAN 80 wings hosts
+  selector: { app.kubernetes.io/name: garage }
+  ports:
+    - { name: s3-api, port: 3900, targetPort: 3900 }
diff --git a/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml b/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml
index d005330c..802197c5 100644
--- a/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml
+++ b/kubernetes/clusters/1276-prod/pelican/pelican/base/externalsecret.yaml
@@ -17,3 +17,9 @@ spec:
     - secretKey: redis-password
       remoteRef:
         key: "1d7a1dc8-b9b3-4265-bdee-b41b0016204f"
+    - secretKey: backup-s3-access-key-id
+      remoteRef:
+        key: "e3e89d3c-67c9-4e4e-903c-b486017d17f9"  # pelican-backups-s3-access-key-id (garage pelican-backups-key, RW pelican-backups only)
+    - secretKey: backup-s3-secret-access-key
+      remoteRef:
+        key: "c3c91067-4df7-467d-8245-b486017d181f"  # pelican-backups-s3-secret-access-key
diff --git a/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml b/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml
index 2569a7df..75b709ad 100644
--- a/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml
+++ b/kubernetes/clusters/1276-prod/pelican/pelican/values.yaml
@@ -51,9 +51,17 @@ envs:
     BEHIND_PROXY: "true"
     APP_ENV: "production"
     APP_INSTALLED: "true"         # keep true — migrate via CLI (Task 1.6); false exposes the public web installer
+    # Native backups -> in-cluster Garage S3 (var names verified against beta35 config/backups.php).
+    APP_BACKUP_DRIVER: "s3"
+    AWS_DEFAULT_REGION: "garage"
+    AWS_BACKUPS_BUCKET: "pelican-backups"
+    AWS_ENDPOINT: "http://garage.kian.sh:3900"
+    AWS_USE_PATH_STYLE_ENDPOINT: "true"   # Garage is non-AWS -> path-style addressing
 
 secretEnvs:
   pelican:
     DB_PASSWORD: db-password
     APP_KEY: app-key
     REDIS_PASSWORD: redis-password
+    AWS_ACCESS_KEY_ID: backup-s3-access-key-id
+    AWS_SECRET_ACCESS_KEY: backup-s3-secret-access-key