diff --git a/clusters/base/infra/longhorn/s3-backup-proxy/helmrelease.yaml b/clusters/base/infra/longhorn/s3-backup-proxy/helmrelease.yaml
new file mode 100644
index 0000000..426d318
--- /dev/null
+++ b/clusters/base/infra/longhorn/s3-backup-proxy/helmrelease.yaml
@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: s3-backup-proxy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: rclone/rclone
+              tag: "1.75.0"
+            command:
+              - sh
+              - -c
+              - |
+                set -eu
+                # crypt's password/password2 must be stored "obscured" (rclone's
+                # reversible obfuscation, not real encryption on its own - the
+                # actual protection is the passphrase's entropy). Generating it
+                # here at startup from the plaintext secret env vars means the
+                # real secret only ever needs to exist as one sops-encrypted
+                # k8s Secret, never hand-obscured and pasted into git.
+                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
+                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
+                cat > /tmp/rclone.conf <<EOF
+                [wasabi]
+                type = s3
+                provider = Wasabi
+                access_key_id = ${WASABI_ACCESS_KEY_ID}
+                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
+                endpoint = s3.eu-central-1.wasabisys.com
+                region = eu-central-1
+
+                [crypt]
+                type = crypt
+                remote = wasabi:kubebackup
+                password = ${CRYPT_PASSWORD_OBS}
+                password2 = ${CRYPT_PASSWORD2_OBS}
+                filename_encryption = standard
+                directory_name_encryption = true
+                EOF
+                exec rclone serve s3 crypt: \
+                  --config /tmp/rclone.conf \
+                  --addr :8080 \
+                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
+            env:
+              WASABI_ACCESS_KEY_ID:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_ACCESS_KEY_ID
+              WASABI_SECRET_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_SECRET_ACCESS_KEY
+              CRYPT_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD
+              CRYPT_PASSWORD2:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD2
+              PROXY_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_ACCESS_KEY
+              PROXY_SECRET_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_SECRET_KEY
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080
diff --git a/clusters/base/infra/longhorn/s3-backup-proxy/helmrepository.yaml b/clusters/base/infra/longhorn/s3-backup-proxy/helmrepository.yaml
new file mode 100644
index 0000000..41f7d4b
--- /dev/null
+++ b/clusters/base/infra/longhorn/s3-backup-proxy/helmrepository.yaml
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"
diff --git a/clusters/base/infra/longhorn/s3-backup-proxy/kustomization.yaml b/clusters/base/infra/longhorn/s3-backup-proxy/kustomization.yaml
new file mode 100644
index 0000000..f6917b9
--- /dev/null
+++ b/clusters/base/infra/longhorn/s3-backup-proxy/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml
diff --git a/clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml b/clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml
new file mode 100644
index 0000000..1524069
--- /dev/null
+++ b/clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-backup-proxy-secrets
+    namespace: longhorn-system
+stringData:
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:YP9bOIarPh6DJVo0vevVN2T3c3A=,iv:bTKwVx/Ij+GMCisO4WEDCJz8rsHe8PtSET/h4+P2dyM=,tag:fdXr+wAx/SvKNwlYlmKvRw==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Aa0ZYxiVipW2g4mGzyhCspVF67m7hnouMg4Tcr6kSinY+ULpHtEDBA==,iv:txr1ual5z7dXi/27T3FOMsccQtSPObHpg+7IfxvfWuw=,tag:MW7fl0iRB/6flbN+iA+2QA==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:x8kMqkX4OzduFbW1BGc2EcFxaVm4ah4BBgLNxzQfIHeuL3UuJXt+Cj8isg==,iv:xoFXHqUDK/yamkDaSaQaMIkC7p+q/4qtsrYNwKT7944=,tag:92nej0/10KVTsugwFzdB0w==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:TdcfVmkgd36Hq80XaLRM8lY2dUq95h4v4ONCy/O7DOMoRwVxDUktgCRgNA==,iv:9EluJOnjKjCo2272sIeJ58iFu54DKfbkX785ZySj3C0=,tag:WUMKDLASA9grCilKNLVmZA==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:A1ZF8ejApPiH3nISLvrO7+vWTzM=,iv:fSFwYL/6zxtK4wkz+G3WItzq6P92eGviQ7WaVquDYuk=,tag:n9fjuW/cXU7QWe5IUkXf/w==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:iU6GHL09tzxgyxcl6wKlDNhaO6YVYS/8yy/qCPbSxE3RlHk0Yw9EnQ==,iv:i0R6SzOJlEDsyEhxLrLMVaJu7ZAzNsnnmdyrxbv6ys0=,tag:h290ZIcFevBQeImcfqQbjg==,type:str]
+sops:
+    age:
+        - recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwaXFldzZyOFVoeVo5eFlh
+            ZkljaHBxdXNhTHhtaUVrZWJDci9nZDR4VlRRCmZTVjVuMWM3dFJTSE9SUzV2V2pj
+            aE1ESENVNWFjZ3l3dmU3T21RZE13cFUKLS0tIDZMZ3BXVWpCbWQwOUFkNk1tU2VU
+            bmlWVURHM3o1NmVvUVZMRi9XMFQ4bUEKQFFAWDVvh1b5kQVsGb/RP6lIKH168G5i
+            M0XRs5dvwg3bcb0IIA5eznUiNHoSEYTPTCt1TziXE9h37/xVbTVJbg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-11T18:28:22Z"
+    mac: ENC[AES256_GCM,data:eICyFKuJAyCE8ZbdpWc4rOHRxtnrFhdxTeznIWXie5CrHRyo+n21CPg5L/VQUy2LF1rXINIDJRNqQWcLXJEXDKWGpqyaL/YcW+OawpbCq0DMJAe/DsvBdy5ySwGFdRlwU5x7ivVjsHKnsr8UgcbHdE/ZVRq93nZOfZlUepjb1u0=,iv:l+SFwIobBbxeZNUmwK6U9W5YpLh4t5GOtnRIH10Z7W4=,tag:6Zs+tneNcF1d5i43ns6Rmw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/clusters/home/infra/kustomization.yaml b/clusters/home/infra/kustomization.yaml
index 315e371..4a66715 100644
--- a/clusters/home/infra/kustomization.yaml
+++ b/clusters/home/infra/kustomization.yaml
@@ -3,5 +3,6 @@ kind: Kustomization
 resources:
   - longhorn/longhorn-system.yaml
   - longhorn/storage-classes.yaml
+  - longhorn/s3-backup-proxy.yaml
   - cert-manager/certificate-issuers.yaml
   - metallb.yaml
diff --git a/clusters/home/infra/longhorn/s3-backup-proxy.yaml b/clusters/home/infra/longhorn/s3-backup-proxy.yaml
new file mode 100644
index 0000000..1310c5b
--- /dev/null
+++ b/clusters/home/infra/longhorn/s3-backup-proxy.yaml
@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: s3-backup-proxy
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/infra/longhorn/s3-backup-proxy
+  prune: true
+  wait: true
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age