diff --git a/.woodpecker/vector-test.yaml b/.woodpecker/vector-test.yaml
index aace88e..5d9180d 100644
--- a/.woodpecker/vector-test.yaml
+++ b/.woodpecker/vector-test.yaml
@@ -14,9 +14,9 @@ steps:
       # Transform tier + VM ingest: unit-tested transforms.
       - vector test apps/base/logging/vector/aggregator.yaml apps/base/logging/vector/aggregator-tests.yaml
       - vector test apps/base/logging/vector/vm-ingest.yaml apps/base/logging/vector/vm-ingest-tests.yaml
-      # Agent + archiver have no transforms to unit-test; validate they build.
+      # Agent has no transforms to unit-test; validate it builds. (The archiver
+      # leg is now the logarchiver service, not a Vector pipeline.)
       - vector validate --no-environment apps/base/logging/vector/agent.yaml
-      - vector validate --no-environment apps/base/logging/vector/archiver.yaml
     backend_options:
       kubernetes:
         serviceAccountName: default
diff --git a/apps/base/logging/configmap_logarchiver.yaml b/apps/base/logging/configmap_logarchiver.yaml
index 0658a43..b6d4996 100644
--- a/apps/base/logging/configmap_logarchiver.yaml
+++ b/apps/base/logging/configmap_logarchiver.yaml
@@ -17,6 +17,16 @@ data:
       max_bytes: 67108864
       max_events: 200000
       max_age: 2m
+    # Pin the proven RGW endpoint/bucket; ignore the secret's S3_ENDPOINT/BUCKET_NAME
+    # (AWS creds still come from the secret env). endpoint_env/bucket_env off.
+    s3:
+      endpoint: "https://s3.ceph.unkin.net"
+      bucket: "logs-archive"
+      region: "us-east-1"
+      path_style: true
+      ca_file: /etc/vault-ca/ca.crt
+      endpoint_env: ""
+      bucket_env: ""
     crypto:
       key_name: logarchive
       pubkey_source: vault