diff --git a/apps/n8n/manifests/cnpg-cluster.yaml b/apps/n8n/manifests/cnpg-cluster.yaml
index b64df8a..7ce7cb8 100644
--- a/apps/n8n/manifests/cnpg-cluster.yaml
+++ b/apps/n8n/manifests/cnpg-cluster.yaml
@@ -47,25 +47,29 @@ spec:
       database: n8n
       owner: n8n
 
-  # Backup to the VPS MinIO backup receiver (Phase 1b). Previously had no
-  # backup block at all. VPS_MINIO_ENDPOINT placeholder matches
-  # infrastructure/vault/manifests/raft-snapshot-cronjob.yaml - replace with
-  # the VPS's actual Netbird address once bootstrapped.
-  backup:
-    barmanObjectStore:
-      destinationPath: s3://cnpg-backups/pg-n8n
-      endpointURL: http://vps-minio.netbird.internal:30900
-      s3Credentials:
-        accessKeyId:
-          name: vps-minio-secret
-          key: accesskey
-        secretAccessKey:
-          name: vps-minio-secret
-          key: secretkey
-      wal:
-        compression: gzip
-        maxParallel: 2
-    retentionPolicy: "30d"
+  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
+  # any route into the Netbird mesh for pod-originated (egress) traffic;
+  # the per-namespace netbird "router" pods are inbound-only infrastructure.
+  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
+  # which held Ready=False permanently (real condition, not cosmetic - this
+  # is what drove n8n's CNPG health flapping in ArgoCD). Re-enable once real
+  # pod-egress routing to the VPS exists (tracked as a separate task) - no
+  # other change needed, this block is otherwise complete/correct.
+  # backup:
+  #   barmanObjectStore:
+  #     destinationPath: s3://cnpg-backups/pg-n8n
+  #     endpointURL: http://vps-minio.netbird.internal:30900
+  #     s3Credentials:
+  #       accessKeyId:
+  #         name: vps-minio-secret
+  #         key: accesskey
+  #       secretAccessKey:
+  #         name: vps-minio-secret
+  #         key: secretkey
+  #     wal:
+  #       compression: gzip
+  #       maxParallel: 2
+  #   retentionPolicy: "30d"
 
   monitoring:
     enablePodMonitor: true
diff --git a/apps/nextcloud/manifests/cnpg-cluster.yaml b/apps/nextcloud/manifests/cnpg-cluster.yaml
index ece9be6..0cef3c0 100644
--- a/apps/nextcloud/manifests/cnpg-cluster.yaml
+++ b/apps/nextcloud/manifests/cnpg-cluster.yaml
@@ -44,25 +44,30 @@ spec:
       database: nextcloud
       owner: nextcloud
 
-  # Backup to the VPS MinIO backup receiver. VPS_MINIO_ENDPOINT placeholder
-  # matches infrastructure/vault/manifests/raft-snapshot-cronjob.yaml - replace
-  # with the VPS's actual Netbird address once bootstrapped. This covers the
-  # DB only - file PVC content is separate, see nextcloud-pvc-sync-cronjob.yaml.
-  backup:
-    barmanObjectStore:
-      destinationPath: s3://cnpg-backups/pg-nextcloud
-      endpointURL: http://vps-minio.netbird.internal:30900
-      s3Credentials:
-        accessKeyId:
-          name: vps-minio-secret
-          key: accesskey
-        secretAccessKey:
-          name: vps-minio-secret
-          key: secretkey
-      wal:
-        compression: gzip
-        maxParallel: 2
-    retentionPolicy: "30d"
+  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
+  # any route into the Netbird mesh for pod-originated (egress) traffic;
+  # the per-namespace netbird "router" pods are inbound-only infrastructure.
+  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
+  # which held Ready=False permanently (real condition, not cosmetic).
+  # Re-enable once real pod-egress routing to the VPS exists (tracked as a
+  # separate task) - no other change needed, this block is otherwise
+  # complete/correct. This covers the DB only - file PVC content is
+  # separate, see nextcloud-pvc-sync-cronjob.yaml (same underlying gap).
+  # backup:
+  #   barmanObjectStore:
+  #     destinationPath: s3://cnpg-backups/pg-nextcloud
+  #     endpointURL: http://vps-minio.netbird.internal:30900
+  #     s3Credentials:
+  #       accessKeyId:
+  #         name: vps-minio-secret
+  #         key: accesskey
+  #       secretAccessKey:
+  #         name: vps-minio-secret
+  #         key: secretkey
+  #     wal:
+  #       compression: gzip
+  #       maxParallel: 2
+  #   retentionPolicy: "30d"
 
   monitoring:
     enablePodMonitor: true
diff --git a/infrastructure/authentik/manifests/cnpg-cluster.yaml b/infrastructure/authentik/manifests/cnpg-cluster.yaml
index 55f5982..23850bf 100644
--- a/infrastructure/authentik/manifests/cnpg-cluster.yaml
+++ b/infrastructure/authentik/manifests/cnpg-cluster.yaml
@@ -47,24 +47,29 @@ spec:
       database: app
       owner: app
 
-  # Backup to the VPS MinIO backup receiver (Phase 1b). VPS_MINIO_ENDPOINT
-  # placeholder matches infrastructure/vault/manifests/raft-snapshot-cronjob.yaml -
-  # replace with the VPS's actual Netbird address once bootstrapped.
-  backup:
-    barmanObjectStore:
-      destinationPath: s3://cnpg-backups/pg-authentik
-      endpointURL: http://vps-minio.netbird.internal:30900
-      s3Credentials:
-        accessKeyId:
-          name: vps-minio-secret
-          key: accesskey
-        secretAccessKey:
-          name: vps-minio-secret
-          key: secretkey
-      wal:
-        compression: gzip
-        maxParallel: 2
-    retentionPolicy: "30d"
+  # Backup to VPS MinIO - DISABLED 2026-08-17. No node in the cluster has
+  # any route into the Netbird mesh for pod-originated (egress) traffic;
+  # the per-namespace netbird "router" pods are inbound-only infrastructure.
+  # continuousArchiving kept failing to connect to vps-minio.netbird.internal,
+  # which held Ready=False permanently (real condition, not cosmetic).
+  # Re-enable once real pod-egress routing to the VPS exists (tracked as a
+  # separate task) - no other change needed, this block is otherwise
+  # complete/correct.
+  # backup:
+  #   barmanObjectStore:
+  #     destinationPath: s3://cnpg-backups/pg-authentik
+  #     endpointURL: http://vps-minio.netbird.internal:30900
+  #     s3Credentials:
+  #       accessKeyId:
+  #         name: vps-minio-secret
+  #         key: accesskey
+  #       secretAccessKey:
+  #         name: vps-minio-secret
+  #         key: secretkey
+  #     wal:
+  #       compression: gzip
+  #       maxParallel: 2
+  #   retentionPolicy: "30d"
 
   monitoring:
     enablePodMonitor: true