diff --git a/clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml b/clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml
index dd16bdd..ba17f42 100644
--- a/clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml
+++ b/clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml
@@ -29,8 +29,12 @@ spec:
       defaultDataPath: /var/lib/longhorn
       guaranteedEngineManagerCPU: 12
       guaranteedReplicaManagerCPU: 12
-      # если backup target ещё не настроен — оставь пустым, донастроишь позже через UI/CR
-      backupTarget: ""
+      # points at the in-cluster rclone proxy (clusters/base/infra/longhorn/s3-backup-proxy),
+      # which itself encrypts and forwards to the real Wasabi bucket. "longhorn-backups" is
+      # a virtual bucket the proxy creates on demand under the crypt remote - already exists.
+      # region is a dummy value; the real endpoint comes from AWS_ENDPOINTS in the secret below.
+      backupTarget: "s3://longhorn-backups@us-east-1/"
+      backupTargetCredentialSecret: longhorn-backup-target-secret
       # чтобы не разъезжались реплики при 3 нодах
       replicaSoftAntiAffinity: false
     persistence:
@@ -44,4 +48,4 @@ spec:
       resizerReplicaCount: 3
       snapshotterReplicaCount: 3
     ingress:
-      enabled: false             # у тебя уже есть Caddy/Traefik, заведёшь свой Ingress/IngressRoute отдельно
\ No newline at end of file
+      enabled: false # exposed via Traefik explicitly
\ No newline at end of file
diff --git a/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml b/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml
index 8210e9c..a0741e9 100644
--- a/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml
+++ b/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helmrepository.yaml
+  - secret.enc.yaml
   - helmrelease.yaml
   - ingress.yaml
diff --git a/clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml b/clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml
new file mode 100644
index 0000000..24d15de
--- /dev/null
+++ b/clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: longhorn-backup-target-secret
+    namespace: longhorn-system
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:QPvQnrkMSKK4Whj7DaMONoDW7LQ=,iv:K1x/VDp4VZUnC7u86wpEfVBDW7T9cI4CZojMZMCaS+A=,tag:eFAAnCMCVjNBHnFAhzFS3w==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:zFjxH1uqnYRrxM4Yrll9Na+mDj16aLtiJC2ZlNO+2r70JcXJqnTASQ==,iv:B7eV80h4APk3QCuoDR9EFpKs5dkMF8GjQ2v9lSF/ev8=,tag:xLbWN0Gy2idB9j2G8HZYKQ==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:HWVPThBb5GLpiRqAuSLvmAat0XiUu5R5CMv2Fv6jdieZ11lUmbS2MBD6lx0vQDSIzC36hd6Tu0hgqtknQA==,iv:XLqWSNHgj8O0uQPeBbnN05Za8G9VW6F802CCPoUoq9A=,tag:dsKXCq21hDlJy4KTyQTp/w==,type:str]
+sops:
+    age:
+        - recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NlhEbXd2dnp6YU8yK2lY
+            QUkvL2p3dTBMTmRnQmM2UjVqaGx4S05iSTI4CjZtZWxDTERWcVVicFlqdWliRmw0
+            eW5zS3lPQmlkRmk3WWNyL01vbjZHUVUKLS0tIHFGUDB3d3FtNmYrQkJ6MzgxYmhU
+            NHEwQytweXloazA5azNPR0ExTE03b3MKPHTMF/rbABGc/hlKI76naGTSQipoegT7
+            mWPHHDtSCCqsKZNXLSs6B7+mLUVLp7AjdCUjD0Me2wo4RdphEDMzHw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-11T19:04:53Z"
+    mac: ENC[AES256_GCM,data:SO2tMq3UA0JcsTZyH3oNhmCsWZ2OhxEmJSn1b/3sH78cZvWalXUsdQqD1GBArFgS+oCSaSgarl2Ve06iNJtM8k6oq0fDkm0dxsLou+67qHlle4CbkP1KPFEQid2Nx8o/5b6cjI2zHz3bYmQTQh9DD7mE8roqo6lX3rYY35MpPJw=,iv:Ad13teWF+lZfzOY/PIALI3/Wohn/0BBoSuE0mtiH8/Y=,tag:sQVQfH0mFFMLnF4zbRC2VQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/clusters/home/infra/longhorn/longhorn-system.yaml b/clusters/home/infra/longhorn/longhorn-system.yaml
index cbac8ca..6efaf46 100644
--- a/clusters/home/infra/longhorn/longhorn-system.yaml
+++ b/clusters/home/infra/longhorn/longhorn-system.yaml
@@ -12,3 +12,7 @@ spec:
   prune: true
   wait: true
   retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age