diff --git a/Vaultwarden.md b/Vaultwarden.md
index 4c436c6..b019844 100644
--- a/Vaultwarden.md
+++ b/Vaultwarden.md
@@ -67,6 +67,26 @@ All Agap API tokens are stored as **individual login entries** in the AI collect
 
 Claude fetches these on demand using `BW_PASSWORD` from its environment.
 
+## Backup
+
+Script: `~/agap_git/vaultwarden/backup.sh`
+Destination: `/mnt/backups/vaultwarden/<timestamp>/`
+Schedule: every 3 days at 2:00 AM (root crontab)
+Retention: last 5 backups
+
+Files backed up:
+- `db_<timestamp>.sqlite3` — via built-in container backup command (safe with live DB)
+- `config.json`
+- `rsa_key.pem`
+- `attachments/`, `sends/` (if present)
+
+Zabbix monitoring: trapper item `vaultwarden.backup.ts` (id `70368`) on host **AgapHost**. Trigger fires at **Warning** if no backup received in 4 days.
+
+Setup (one-time, as root):
+```bash
+sudo bash /tmp/setup-vaultwarden-backup.sh  # saves Zabbix token, installs cron, runs test backup
+```
+
 ## Notes
 
 - `ADMIN_TOKEN` is an argon2id hash — generate with `vaultwarden hash` or use the web tool