diff --git a/clusters/base/infra/longhorn/longhorn-system/backuptarget.yaml b/clusters/base/infra/longhorn/longhorn-system/backuptarget.yaml
new file mode 100644
index 0000000..32b54af
--- /dev/null
+++ b/clusters/base/infra/longhorn/longhorn-system/backuptarget.yaml
@@ -0,0 +1,13 @@
+apiVersion: longhorn.io/v1beta2
+kind: BackupTarget
+metadata:
+  name: default
+  namespace: longhorn-system
+spec:
+  # this CR (not defaultSettings.backupTarget in helmrelease.yaml) is what
+  # Longhorn actually reads - it pre-existed this repo's management,
+  # pointing at a long-dead minio host. defaultSettings only seeds it on
+  # a truly fresh install, so it never overwrote the stale live object.
+  backupTargetURL: "s3://longhorn-backups@us-east-1/"
+  credentialSecret: longhorn-backup-target-secret
+  pollInterval: 5m0s
diff --git a/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml b/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml
index a0741e9..e6f453e 100644
--- a/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml
+++ b/clusters/base/infra/longhorn/longhorn-system/kustomization.yaml
@@ -5,3 +5,4 @@ resources:
   - secret.enc.yaml
   - helmrelease.yaml
   - ingress.yaml
+  - backuptarget.yaml