diff --git a/apps/base/artifactapi/cnpg_backup.yaml b/apps/base/artifactapi/cnpg_backup.yaml
index 72c1efe..e96d678 100644
--- a/apps/base/artifactapi/cnpg_backup.yaml
+++ b/apps/base/artifactapi/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-artifactapi
+  namespace: artifactapi
+spec:
+  placementTarget: ec
+  bucketName: cnpg-artifactapi
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-artifactapi-backup
+  versioning: false
+  tags:
+    app: artifactapi
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/authentik/cnpg_backup.yaml b/apps/base/authentik/cnpg_backup.yaml
index 7167dae..a10a041 100644
--- a/apps/base/authentik/cnpg_backup.yaml
+++ b/apps/base/authentik/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-authentik
+  namespace: authentik
+spec:
+  placementTarget: ec
+  bucketName: cnpg-authentik
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-authentik-backup
+  versioning: false
+  tags:
+    app: authentik
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/encapi/cnpg_backup.yaml b/apps/base/encapi/cnpg_backup.yaml
index a7bcf5d..a03ca84 100644
--- a/apps/base/encapi/cnpg_backup.yaml
+++ b/apps/base/encapi/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-encapi
+  namespace: encapi
+spec:
+  placementTarget: ec
+  bucketName: cnpg-encapi
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-encapi-backup
+  versioning: false
+  tags:
+    app: encapi
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/grafana/cnpg_backup.yaml b/apps/base/grafana/cnpg_backup.yaml
index 9d6f9df..654d23b 100644
--- a/apps/base/grafana/cnpg_backup.yaml
+++ b/apps/base/grafana/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-grafana
+  namespace: grafana
+spec:
+  placementTarget: ec
+  bucketName: cnpg-grafana
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-grafana-backup
+  versioning: false
+  tags:
+    app: grafana
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/litellm/cnpg_backup.yaml b/apps/base/litellm/cnpg_backup.yaml
index c4bee5c..05710b0 100644
--- a/apps/base/litellm/cnpg_backup.yaml
+++ b/apps/base/litellm/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-litellm
+  namespace: litellm
+spec:
+  placementTarget: ec
+  bucketName: cnpg-litellm
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-litellm-backup
+  versioning: false
+  tags:
+    app: litellm
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/netbox/cnpg_backup.yaml b/apps/base/netbox/cnpg_backup.yaml
index d32ecfd..bb4e2fd 100644
--- a/apps/base/netbox/cnpg_backup.yaml
+++ b/apps/base/netbox/cnpg_backup.yaml
@@ -19,6 +19,21 @@ spec:
   # Keep the RGW user (and thus the keys) if this CR is ever deleted.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-netbox
+  namespace: netbox
+spec:
+  placementTarget: ec
+  bucketName: cnpg-netbox
+  ownerRef: cnpg-netbox-backup
+  versioning: false
+  tags:
+    app: netbox
+    purpose: cnpg-backup
+  retainOnDelete: true
+---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
diff --git a/apps/base/paperclip/cnpg_backup.yaml b/apps/base/paperclip/cnpg_backup.yaml
index c3f2e90..19660f2 100644
--- a/apps/base/paperclip/cnpg_backup.yaml
+++ b/apps/base/paperclip/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-paperclip
+  namespace: paperclip
+spec:
+  placementTarget: ec
+  bucketName: cnpg-paperclip
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-paperclip-backup
+  versioning: false
+  tags:
+    app: paperclip
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/puppet/cnpg_backup.yaml b/apps/base/puppet/cnpg_backup.yaml
index 65aec28..0251a81 100644
--- a/apps/base/puppet/cnpg_backup.yaml
+++ b/apps/base/puppet/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-puppet
+  namespace: puppet
+spec:
+  placementTarget: ec
+  bucketName: cnpg-puppet
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-puppet-backup
+  versioning: false
+  tags:
+    app: puppet
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8
diff --git a/apps/base/woodpecker/cnpg_backup.yaml b/apps/base/woodpecker/cnpg_backup.yaml
index d9e6ce9..7dd023e 100644
--- a/apps/base/woodpecker/cnpg_backup.yaml
+++ b/apps/base/woodpecker/cnpg_backup.yaml
@@ -20,6 +20,24 @@ spec:
   # in-flight restore can still reach the archive.
   retainOnDelete: true
 ---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: cnpg-woodpecker
+  namespace: woodpecker
+spec:
+  placementTarget: ec
+  bucketName: cnpg-woodpecker
+  # The owner user has full control of its own bucket (read + write), which is
+  # all the backup/restore identity needs — no extra BucketAccess grant.
+  ownerRef: cnpg-woodpecker-backup
+  versioning: false
+  tags:
+    app: woodpecker
+    purpose: cnpg-backup
+  # Never drop the backups if the CR is removed; retire buckets by hand.
+  retainOnDelete: true
+---
 # Nightly base backup. Continuous WAL archiving is always-on via the Cluster's
 # spec.backup.barmanObjectStore; this schedules the periodic full backup that
 # WAL is layered on top of. Schedules are staggered across clusters so the 8