diff --git a/apps/base/jellyfin/cephrgw-config-backup.yaml b/apps/base/jellyfin/cephrgw-config-backup.yaml
new file mode 100644
index 0000000..14ad7ed
--- /dev/null
+++ b/apps/base/jellyfin/cephrgw-config-backup.yaml
@@ -0,0 +1,32 @@
+---
+# Second Ceph RGW (S3) bucket owned by the existing jellyfin backup user
+# (cnpg-jellyfin-backup, defined in cnpg_backup.yaml) — one user, two buckets:
+# the CNPG barman bucket plus this one, which k8up uses to hold restic backups
+# of the jellyfin-config PVC. The BucketAccess emits read-write S3 creds into a
+# Secret the k8up Schedule consumes.
+apiVersion: ceph.unkin.net/v1alpha1
+kind: Bucket
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  placementTarget: ec
+  bucketName: jellyfin-config-backup
+  ownerRef: cnpg-jellyfin-backup
+  versioning: false
+  tags:
+    app: jellyfin
+    purpose: config-backup
+  retainOnDelete: true
+---
+apiVersion: ceph.unkin.net/v1alpha1
+kind: BucketAccess
+metadata:
+  name: jellyfin-config-backup
+  namespace: jellyfin
+spec:
+  bucketRef: jellyfin-config-backup
+  level: read-write
+  # Operator writes AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY (+ S3_ENDPOINT,
+  # BUCKET_NAME) into this Secret; the k8up Schedule reads the access keys.
+  secretName: jellyfin-config-backup-s3
diff --git a/apps/base/jellyfin/kustomization.yaml b/apps/base/jellyfin/kustomization.yaml
index 2c4117d..edab63d 100644
--- a/apps/base/jellyfin/kustomization.yaml
+++ b/apps/base/jellyfin/kustomization.yaml
@@ -7,6 +7,7 @@ resources:
   - cnpg_cluster.yaml
   - cnpg_pooler.yaml
   - cnpg_backup.yaml
+  - cephrgw-config-backup.yaml
   - pvc-config.yaml
   - pvc-transcode.yaml
   - pvc-media-tv.yaml