diff --git a/apps/nextcloud/manifests/pvc-sync-cronjob.yaml b/apps/nextcloud/manifests/pvc-sync-cronjob.yaml
index e93d302..83d873c 100644
--- a/apps/nextcloud/manifests/pvc-sync-cronjob.yaml
+++ b/apps/nextcloud/manifests/pvc-sync-cronjob.yaml
@@ -63,6 +63,11 @@ spec:
           securityContext:
             runAsNonRoot: true
             runAsUser: 65534
+            # Matches the real nextcloud Deployment's fsGroup (33/www-data) -
+            # without it this job can't read the PVC data at all (confirmed
+            # live 2026-08-18: "permission denied" on every file/dir under
+            # /data once it could actually reach the VPS to back up to).
+            fsGroup: 33
             seccompProfile:
               type: RuntimeDefault
           affinity:
@@ -88,6 +93,10 @@ spec:
                   export RESTIC_PASSWORD_FILE=/restic-secret/password
                   export AWS_ACCESS_KEY_ID="${MINIO_ACCESS_KEY}"
                   export AWS_SECRET_ACCESS_KEY="${MINIO_SECRET_KEY}"
+                  # Default cache dir is $HOME/.cache - runAsUser 65534 has
+                  # no writable HOME, restic errors with "mkdir /.cache:
+                  # permission denied" otherwise.
+                  export RESTIC_CACHE_DIR=/tmp/restic-cache
 
                   restic snapshots >/dev/null 2>&1 || restic init