diff --git a/apps/n8n/manifests/scheduled-backup.yaml b/apps/n8n/manifests/scheduled-backup.yaml
new file mode 100644
index 0000000..65b6b7e
--- /dev/null
+++ b/apps/n8n/manifests/scheduled-backup.yaml
@@ -0,0 +1,16 @@
+---
+# Same gap/fix as infrastructure/authentik/manifests/scheduled-backup.yaml -
+# see that file for the full explanation. WAL-only barmanObjectStore
+# config has no restorable base backup without this.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-n8n-backup
+  namespace: n8n
+spec:
+  schedule: "0 1 * * *"
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-n8n
diff --git a/apps/nextcloud/manifests/scheduled-backup.yaml b/apps/nextcloud/manifests/scheduled-backup.yaml
new file mode 100644
index 0000000..5d0b41c
--- /dev/null
+++ b/apps/nextcloud/manifests/scheduled-backup.yaml
@@ -0,0 +1,16 @@
+---
+# Same gap/fix as infrastructure/authentik/manifests/scheduled-backup.yaml -
+# see that file for the full explanation. WAL-only barmanObjectStore
+# config has no restorable base backup without this.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-nextcloud-backup
+  namespace: nextcloud
+spec:
+  schedule: "0 1 * * *"
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-nextcloud
diff --git a/infrastructure/authentik/manifests/scheduled-backup.yaml b/infrastructure/authentik/manifests/scheduled-backup.yaml
new file mode 100644
index 0000000..e4c27a7
--- /dev/null
+++ b/infrastructure/authentik/manifests/scheduled-backup.yaml
@@ -0,0 +1,26 @@
+---
+# Found 2026-08-18 while building the VPS Authentik replica cluster: the
+# barmanObjectStore backup: block on cnpg-cluster.yaml only configures
+# continuous WAL archiving - it does NOT itself produce a restorable base
+# backup. CNPG's bootstrap.recovery (used by
+# infrastructure/vps-standby/authentik/manifests/cnpg-cluster.yaml) needs
+# at least one actual Backup object to exist before it has anything to
+# restore ("no target backup found" otherwise, confirmed live). This gap
+# was systemic - n8n, nextcloud, and gitlab all had the same WAL-only
+# setup with no ScheduledBackup anywhere in the repo.
+#
+# immediate: true also fires one backup right away on creation, not just
+# on the schedule - needed to unblock the VPS restore immediately rather
+# than waiting up to 24h for the first scheduled run.
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: pg-authentik-backup
+  namespace: authentik
+spec:
+  schedule: "0 1 * * *"  # daily 01:00 - ahead of the VPS's other restore/replay jobs
+  backupOwnerReference: self
+  immediate: true
+  method: barmanObjectStore
+  cluster:
+    name: pg-authentik