diff --git a/k8s/README.md b/k8s/README.md
index c14e2e6..0c0c9f1 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -141,6 +141,25 @@ DATE=$( date +%Y%m%d )
 velero backup create $DATE --include-namespaces coder,home-assistant,n8n,influxdb --wait
 ```
 
+### Backup Retention Policy
+
+Three schedules run automatically, providing a tiered retention policy. Kopia (used for fs-backup) deduplicates at the block level, so each backup only stores changed data — incrementals come for free.
+
+| Schedule | Cron | TTL | Keeps |
+|---|---|---|---|
+| `velero-daily-backup` | `0 2 * * *` | 8 days | Last 7 daily backups |
+| `velero-weekly-backup` | `0 3 * * 0` | 43 days | Last 6 weekly backups (Sundays) |
+| `velero-monthly-backup` | `0 4 1 * *` | 183 days | Last 6 monthly backups (1st of month) |
+
+```sh
+# Check all schedules and their last run
+velero schedule get
+
+# Check current backups and their expiry
+velero backup get
+```
+
+
 ## coder
 
 Coder is a code server see [https://coder.com/docs/v2/latest/install/kubernetes](https://coder.com/docs/v2/latest/install/kubernetes).
diff --git a/k8s/velero/velero.secret.yaml b/k8s/velero/velero.secret.yaml
index 4943736..6cf5787 100644
Binary files a/k8s/velero/velero.secret.yaml and b/k8s/velero/velero.secret.yaml differ