diff --git a/.github/workflows/worker-preview.yml b/.github/workflows/worker-preview.yml
new file mode 100644
index 000000000..9def1905d
--- /dev/null
+++ b/.github/workflows/worker-preview.yml
@@ -0,0 +1,79 @@
+name: Worker Preview
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  preview:
+    if: github.event.action != 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - run: cp wrangler.example.jsonc wrangler.jsonc
+      - name: Configure preview auth URL
+        env:
+          PREVIEW_NAME: pr-${{ github.event.pull_request.number }}
+        run: |
+          preview_url="https://${PREVIEW_NAME}-splitpro.andrepascoa.workers.dev"
+          sed -i "s|https://replace-with-this-preview-url|${preview_url}|g" wrangler.jsonc
+      - run: SKIP_ENV_VALIDATION=1 pnpm build
+      - name: Apply preview database migrations
+        run: pnpm exec wrangler d1 migrations apply DB --remote --preview --config wrangler.jsonc
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
+      - name: Deploy Worker Preview
+        id: preview
+        run: |
+          output="$(pnpm exec wrangler preview --name "pr-${{ github.event.pull_request.number }}" --json)"
+          printf '%s\n' "$output"
+          url="$(printf '%s' "$output" | node -e 'let output = ""; process.stdin.on("data", chunk => output += chunk); process.stdin.on("end", () => { const match = output.match(/"preview":\s*\{[\s\S]*?"urls":\s*\[\s*"([^"]+)"/); if (!match) process.exit(1); process.stdout.write(match[1]); });')"
+          echo "url=$url" >> "$GITHUB_OUTPUT"
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
+      - name: Add or update preview comment
+        uses: actions/github-script@v7
+        env:
+          PREVIEW_URL: ${{ steps.preview.outputs.url }}
+        with:
+          script: |
+            const marker = '<!-- worker-preview -->';
+            const body = `${marker}\n🚀 Worker preview: ${process.env.PREVIEW_URL}`;
+            const { owner, repo } = context.repo;
+            const issue_number = context.issue.number;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
+            const existing = comments.find((comment) => comment.body?.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            }
+
+  cleanup:
+    if: github.event.action == 'closed' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --prefer-offline
+      - run: cp wrangler.example.jsonc wrangler.jsonc
+      - run: pnpm exec wrangler preview delete --name "pr-${{ github.event.pull_request.number }}" --skip-confirmation
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CF_PREVIEW_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: 4c52a530606031af4f6ca06e32ca1ec5
diff --git a/README.md b/README.md
index 53df55798..47cf417ef 100644
--- a/README.md
+++ b/README.md
@@ -85,6 +85,29 @@ setting belongs only in `previews.vars`, not production `vars`.
 - `drizzle-kit` and `wrangler d1 migrations` own the schema. `migrations/0001_balance_view_and_triggers.sql`
   is hand-written (the `BalanceView` view and a trigger). Back it up before regenerating migrations.
 
+## Backups
+
+- **Time Travel:** D1 keeps point-in-time history for 30 days on the Workers Paid plan.
+  Restore with `npx wrangler d1 time-travel restore splitpro --timestamp=<unix>`.
+- **Daily backup to R2:** the `splitpro-backup` Workflow (03:00 UTC) exports D1 through the REST API
+  to `d1/splitpro-<date>-<time>.sql`, then writes a JSON manifest beside it. It also paginates the
+  `UPLOADS` bucket and copies new or changed objects to `uploads/<original-key>` in the private
+  `splitpro-backups` bucket, preserving HTTP and custom metadata. Existing upload copies are retained
+  even if their source object is later deleted, so R2 upload backups are not pruned automatically.
+  SQL dumps and manifests older than `BACKUP_RETENTION_DAYS` (default 90) are pruned. The D1 export
+  endpoint may block database requests while an export is running. It needs the `D1_EXPORT_TOKEN`
+  secret (an API token with **D1 Write**; the endpoint rejects D1 Read), and the `CF_ACCOUNT_ID` and
+  `D1_DATABASE_ID` vars.
+- **Restore:** load a SQL dump into a database with
+  `npx wrangler d1 execute <db> --remote --file <dump>.sql`, then copy objects under the backup
+  bucket's `uploads/` prefix back to `UPLOADS`, removing that prefix from each key. The application
+  code, migrations, and non-secret Worker configuration are in Git. Recreate Worker secrets from a
+  secure password manager; they cannot be recovered from a database or R2 dump.
+- Both buckets are in the same Cloudflare account. This protects against application-level deletion
+  from `UPLOADS`, but not account compromise or account-wide deletion; keep an additional copy in a
+  separate account or provider for that threat model.
+- Trigger one by hand: `npx wrangler workflows trigger splitpro-backup`.
+
 ## Tests
 
 ```sh
diff --git a/src/components/AddExpense/AddBankTransactions.tsx b/src/components/AddExpense/AddBankTransactions.tsx
index b5d1aa268..5ecfd67f6 100644
--- a/src/components/AddExpense/AddBankTransactions.tsx
+++ b/src/components/AddExpense/AddBankTransactions.tsx
@@ -1,4 +1,5 @@
 import React, { useCallback } from 'react';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { calculateParticipantSplit, useAddExpenseStore } from '~/store/addStore';
 import type { TransactionAddInputModel } from '~/types';
 import { BankingTransactionList } from './BankTransactions/BankingTransactionList';
@@ -35,6 +36,7 @@ const AddBankTransactions: React.FC<{
   } = useAddExpenseStore((s) => s.actions);
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const router = useRouter();
 
@@ -99,7 +101,8 @@ const AddBankTransactions: React.FC<{
       }) as CreateExpense[];
 
     await addExpenseMutation.mutateAsync(expenses, {
-      onSuccess: () => {
+      onSuccess: async () => {
+        await invalidateExpenseQueries();
         setMultipleTransactions([]);
         setIsTransactionLoading(false);
         router.back();
@@ -114,6 +117,7 @@ const AddBankTransactions: React.FC<{
     router,
     resetState,
     addExpenseMutation,
+    invalidateExpenseQueries,
     group,
     paidBy,
     splitType,
diff --git a/src/components/AddExpense/AddExpensePage.tsx b/src/components/AddExpense/AddExpensePage.tsx
index 77ce43b43..00e9afba8 100644
--- a/src/components/AddExpense/AddExpensePage.tsx
+++ b/src/components/AddExpense/AddExpensePage.tsx
@@ -5,6 +5,7 @@ import { useRouter } from 'next/router';
 import React, { useCallback } from 'react';
 
 import { type CurrencyCode } from '~/lib/currency';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { useAddExpenseStore } from '~/store/addStore';
 import { api } from '~/utils/api';
 
@@ -72,6 +73,7 @@ export const AddOrEditExpensePage: React.FC<{
   } = useAddExpenseStore((s) => s.actions);
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
   const updateProfile = api.user.updateUserDetail.useMutation();
   const { update } = useSession();
 
@@ -137,8 +139,10 @@ export const AddOrEditExpensePage: React.FC<{
           },
         ],
         {
-          onSuccess: (d) => {
+          onSuccess: async (d) => {
             if (d) {
+              await invalidateExpenseQueries();
+
               if (multipleTransactions.length > 0) {
                 const allTransactions = [...multipleTransactions];
                 const transactionToAdd = allTransactions.pop();
@@ -198,6 +202,7 @@ export const AddOrEditExpensePage: React.FC<{
     expenseId,
     router,
     addExpenseMutation,
+    invalidateExpenseQueries,
     group,
     paidBy,
     splitType,
diff --git a/src/components/Expense/DeleteExpense.tsx b/src/components/Expense/DeleteExpense.tsx
index ea25baabd..4763719c2 100644
--- a/src/components/Expense/DeleteExpense.tsx
+++ b/src/components/Expense/DeleteExpense.tsx
@@ -6,6 +6,7 @@ import { useTranslation } from 'next-i18next';
 import { toast } from 'sonner';
 
 import { extractTemplateExpenseId } from '~/lib/cron';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { api } from '~/utils/api';
 
 import { Button } from '../ui/button';
@@ -26,6 +27,7 @@ export const DeleteExpense: React.FC<DeleteExpenseProps> = ({ expenseId, recurre
   const router = useRouter();
 
   const deleteExpenseMutation = api.expense.deleteExpense.useMutation();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const isTemplate = useMemo(
     () => (recurrence ? extractTemplateExpenseId(recurrence.job.command) === expenseId : false),
@@ -36,6 +38,7 @@ export const DeleteExpense: React.FC<DeleteExpenseProps> = ({ expenseId, recurre
   const onDeleteExpense = useCallback(async () => {
     try {
       await deleteExpenseMutation.mutateAsync({ expenseId });
+      await invalidateExpenseQueries();
     } catch (error) {
       if (error instanceof Error) {
         toast.error(`Error: ${error.message}`);
@@ -46,7 +49,7 @@ export const DeleteExpense: React.FC<DeleteExpenseProps> = ({ expenseId, recurre
       return;
     }
     router.back();
-  }, [expenseId, deleteExpenseMutation, router]);
+  }, [expenseId, deleteExpenseMutation, invalidateExpenseQueries, router]);
 
   const description = useMemo(() => {
     if (!isPartOfRecurrence) {
diff --git a/src/components/Expense/ExpenseDetails.tsx b/src/components/Expense/ExpenseDetails.tsx
index 47766863f..f9bed4c43 100644
--- a/src/components/Expense/ExpenseDetails.tsx
+++ b/src/components/Expense/ExpenseDetails.tsx
@@ -9,6 +9,7 @@ import React, { type ComponentProps, useCallback, useMemo, useState } from 'reac
 import { toast } from 'sonner';
 
 import { useIntlCronParser } from '~/hooks/useIntlCronParser';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { useTranslationWithUtils } from '~/hooks/useTranslationWithUtils';
 import { cronFromBackend } from '~/lib/cron';
 import { DEFAULT_CATEGORY } from '~/lib/category';
@@ -272,7 +273,7 @@ export const EditSettlement: React.FC<{ expense: ExpenseDetailsOutput }> = ({ ex
   );
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
-  const apiUtils = api.useUtils();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const onCurrencyInputValueChange = useCallback(
     ({ strValue, bigIntValue }: { strValue?: string; bigIntValue?: bigint }) => {
@@ -314,8 +315,8 @@ export const EditSettlement: React.FC<{ expense: ExpenseDetailsOutput }> = ({ ex
         expenseDate,
       },
       {
-        onSuccess: () => {
-          apiUtils.invalidate().catch(console.error);
+        onSuccess: async () => {
+          await invalidateExpenseQueries();
         },
         onError: (error) => {
           console.error('Error while saving expense:', error);
@@ -323,7 +324,16 @@ export const EditSettlement: React.FC<{ expense: ExpenseDetailsOutput }> = ({ ex
         },
       },
     );
-  }, [amount, sender, receiver, expense, addExpenseMutation, expenseDate, apiUtils, t]);
+  }, [
+    amount,
+    sender,
+    receiver,
+    expense,
+    addExpenseMutation,
+    expenseDate,
+    invalidateExpenseQueries,
+    t,
+  ]);
 
   if (!sender || !receiver) {
     return null;
diff --git a/src/components/Friend/GroupSettleup.tsx b/src/components/Friend/GroupSettleup.tsx
index 186547a4f..e231e0bd2 100644
--- a/src/components/Friend/GroupSettleup.tsx
+++ b/src/components/Friend/GroupSettleup.tsx
@@ -2,6 +2,7 @@ import { SplitType, type User } from '~/server/db/types';
 import { ArrowRightIcon } from 'lucide-react';
 import React, { type ReactNode, useState } from 'react';
 import { toast } from 'sonner';
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { useTranslationWithUtils } from '~/hooks/useTranslationWithUtils';
 import { DEFAULT_CATEGORY } from '~/lib/category';
 import { api } from '~/utils/api';
@@ -38,7 +39,7 @@ export const GroupSettleUp: React.FC<{
   );
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
-  const utils = api.useUtils();
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
 
   const sender = 0 > _amount ? user : friend;
   const receiver = 0 > _amount ? friend : user;
@@ -69,8 +70,8 @@ export const GroupSettleUp: React.FC<{
         category: DEFAULT_CATEGORY,
       },
       {
-        onSuccess: () => {
-          utils.group.invalidate().catch(console.error);
+        onSuccess: async () => {
+          await invalidateExpenseQueries();
         },
         onError: (error) => {
           console.error('Error while saving expense:', error);
@@ -78,7 +79,16 @@ export const GroupSettleUp: React.FC<{
         },
       },
     );
-  }, [sender, receiver, amount, utils, addExpenseMutation, currency, groupId, t]);
+  }, [
+    sender,
+    receiver,
+    amount,
+    invalidateExpenseQueries,
+    addExpenseMutation,
+    currency,
+    groupId,
+    t,
+  ]);
 
   return (
     <AppDrawer
diff --git a/src/components/Friend/Settleup.tsx b/src/components/Friend/Settleup.tsx
index e7704b26c..682b5064d 100644
--- a/src/components/Friend/Settleup.tsx
+++ b/src/components/Friend/Settleup.tsx
@@ -1,8 +1,9 @@
 import { SplitType, type User } from '~/server/db/types';
 import { ArrowRightIcon } from 'lucide-react';
-import React, { useState } from 'react';
+import React, { useEffect, useState } from 'react';
 import { toast } from 'sonner';
 
+import { useInvalidateExpenseQueries } from '~/hooks/useInvalidateExpenseQueries';
 import { DEFAULT_CATEGORY } from '~/lib/category';
 import { api } from '~/utils/api';
 import { BigMath } from '~/utils/numbers';
@@ -25,29 +26,27 @@ export const SettleUp: React.FC<
   const { t, displayName, getCurrencyHelpersCached } = useTranslationWithUtils();
   const { data } = useSession();
   const currentUser = data?.user;
-
-  if (!currentUser) {
-    return null;
-  }
-
-  if (!balances) {
-    return (
-      <Button size="sm" variant="outline" responsiveIcon disabled>
-        <span className="xs:inline hidden">{t('actions.settle_up')}</span>
-      </Button>
-    );
-  }
+  const invalidateExpenseQueries = useInvalidateExpenseQueries();
+  const availableBalances = balances ?? [];
 
   const [balanceToSettle, setBalanceToSettle] = useState<MinimalBalance | undefined>(
-    1 < balances.length ? undefined : balances[0],
+    1 === availableBalances.length ? availableBalances[0] : undefined,
   );
   const [amount, setAmount] = useState<bigint>(
-    1 < balances.length ? 0n : BigMath.abs(balances[0]?.amount ?? 0n),
+    1 === availableBalances.length ? BigMath.abs(availableBalances[0]?.amount ?? 0n) : 0n,
   );
   const [amountStr, setAmountStr] = useState<string>(
     getCurrencyHelpersCached(balanceToSettle?.currency ?? '').toUIString(amount),
   );
 
+  useEffect(() => {
+    const nextBalance = 1 === balances?.length ? balances[0] : undefined;
+    const nextAmount = BigMath.abs(nextBalance?.amount ?? 0n);
+    setBalanceToSettle(nextBalance);
+    setAmount(nextAmount);
+    setAmountStr(getCurrencyHelpersCached(nextBalance?.currency ?? '').toUIString(nextAmount));
+  }, [balances, getCurrencyHelpersCached]);
+
   const isCurrentUserPaying = 0 > (balanceToSettle?.amount ?? 0);
 
   function onSelectBalance(balance: MinimalBalance) {
@@ -59,7 +58,6 @@ export const SettleUp: React.FC<
   }
 
   const addExpenseMutation = api.expense.addOrEditExpense.useMutation();
-  const utils = api.useUtils();
 
   const saveExpense = React.useCallback(() => {
     if (!balanceToSettle || !amount || !currentUser) {
@@ -87,9 +85,8 @@ export const SettleUp: React.FC<
         groupId: balanceToSettle.groupId,
       },
       {
-        onSuccess: () => {
-          utils.user.invalidate().catch(console.error);
-          utils.expense.invalidate().catch(console.error);
+        onSuccess: async () => {
+          await invalidateExpenseQueries();
         },
         onError: (error) => {
           console.error('Error while saving expense:', error);
@@ -104,7 +101,7 @@ export const SettleUp: React.FC<
     isCurrentUserPaying,
     friend,
     addExpenseMutation,
-    utils,
+    invalidateExpenseQueries,
     t,
   ]);
 
@@ -126,6 +123,18 @@ export const SettleUp: React.FC<
     }
   }, [balanceToSettle]);
 
+  if (!currentUser) {
+    return null;
+  }
+
+  if (!balances) {
+    return (
+      <Button size="sm" variant="outline" responsiveIcon disabled>
+        <span className="xs:inline hidden">{t('actions.settle_up')}</span>
+      </Button>
+    );
+  }
+
   return (
     <AppDrawer
       trigger={children}
@@ -142,7 +151,7 @@ export const SettleUp: React.FC<
     >
       {!balanceToSettle ? (
         <div>
-          {balances?.map((b) => (
+          {availableBalances.map((b) => (
             <div
               key={`${b.friendId}-${b.currency}-${b.groupId ?? 'null'}`}
               onClick={() => onSelectBalance(b)}
diff --git a/src/hooks/useInvalidateExpenseQueries.ts b/src/hooks/useInvalidateExpenseQueries.ts
new file mode 100644
index 000000000..4af761a76
--- /dev/null
+++ b/src/hooks/useInvalidateExpenseQueries.ts
@@ -0,0 +1,15 @@
+import { useCallback } from 'react';
+
+import { api } from '~/utils/api';
+
+export const useInvalidateExpenseQueries = () => {
+  const utils = api.useUtils();
+
+  return useCallback(async () => {
+    await Promise.all([
+      utils.expense.invalidate(),
+      utils.user.invalidate(),
+      utils.group.invalidate(),
+    ]);
+  }, [utils]);
+};
diff --git a/src/server/db/index.ts b/src/server/db/index.ts
index 5454b7f1f..c6b025f47 100644
--- a/src/server/db/index.ts
+++ b/src/server/db/index.ts
@@ -9,8 +9,14 @@ export type DB = DrizzleD1Database<typeof schema>;
 export interface AppBindings {
   DB: D1Database;
   UPLOADS: R2Bucket;
+  BACKUPS: R2Bucket;
   EMAIL?: SendEmail;
   SCHEDULER?: Workflow;
+  BACKUP?: Workflow;
+  CF_ACCOUNT_ID: string;
+  D1_DATABASE_ID: string;
+  D1_EXPORT_TOKEN: string;
+  BACKUP_RETENTION_DAYS?: string;
   [key: string]: unknown;
 }
 
diff --git a/src/server/workflows/backup.ts b/src/server/workflows/backup.ts
new file mode 100644
index 000000000..b836a2e60
--- /dev/null
+++ b/src/server/workflows/backup.ts
@@ -0,0 +1,171 @@
+/**
+ * Backup Workflow: exports D1 and mirrors uploaded files to a private R2 bucket once a day.
+ *
+ * D1 Time Travel already allows point-in-time restores for 30 days (Workers Paid). These dumps
+ * are for longer retention and for restoring into a fresh database. Restore with
+ * `wrangler d1 execute <db> --remote --file <dump>.sql`.
+ *
+ * Uses the D1 REST export API (consistent snapshot, includes views and triggers), so it needs
+ * the `D1_EXPORT_TOKEN` secret (a scoped API token) plus the CF_ACCOUNT_ID and D1_DATABASE_ID vars.
+ */
+import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from 'cloudflare:workers';
+
+import { type AppBindings } from '~/server/db';
+import { logError } from '~/server/observability/errorLog';
+import { copyUploadPage, type UploadObjectSummary } from './backupStorage';
+import { getD1ExportFile, isD1ExportResponse } from './backupProtocol';
+
+const D1_PREFIX = 'd1/';
+const UPLOADS_PREFIX = 'uploads/';
+const DEFAULT_RETENTION_DAYS = 90;
+const UPLOADS_PAGE_SIZE = 100;
+
+const steps = {
+  start: { retries: { limit: 5, delay: '15 seconds', backoff: 'exponential' } },
+  // The export is prepared asynchronously; poll until the signed URL is ready.
+  poll: { retries: { limit: 20, delay: '15 seconds', backoff: 'constant' } },
+  list: { retries: { limit: 5, delay: '15 seconds', backoff: 'exponential' } },
+  copy: {
+    retries: { limit: 5, delay: '30 seconds', backoff: 'exponential' },
+    timeout: '25 minutes',
+  },
+  store: { retries: { limit: 5, delay: '30 seconds', backoff: 'exponential' } },
+} as const;
+
+export class BackupWorkflow extends WorkflowEntrypoint<AppBindings> {
+  async run(event: WorkflowEvent<unknown>, step: WorkflowStep) {
+    const env = this.env;
+    const when = new Date(event.schedule?.scheduledTime ?? event.timestamp.getTime());
+    const retentionDays = Number(env.BACKUP_RETENTION_DAYS ?? DEFAULT_RETENTION_DAYS);
+    if (!Number.isInteger(retentionDays) || retentionDays < 1) {
+      throw new Error('BACKUP_RETENTION_DAYS must be a positive integer');
+    }
+
+    const day = when.toISOString().slice(0, 10);
+    const time = when.toISOString().slice(11, 16).replace(':', '');
+    const exportUrl = `https://api.cloudflare.com/client/v4/accounts/${env.CF_ACCOUNT_ID}/d1/database/${env.D1_DATABASE_ID}/export`;
+
+    const call = async (body: Record<string, unknown>) => {
+      const response = await fetch(exportUrl, {
+        method: 'POST',
+        headers: {
+          authorization: `Bearer ${env.D1_EXPORT_TOKEN}`,
+          'content-type': 'application/json',
+        },
+        body: JSON.stringify(body),
+      });
+      const json: unknown = await response.json();
+      if (!isD1ExportResponse(json)) {
+        throw new Error(`D1 export API ${response.status}: invalid response`);
+      }
+      if (!response.ok || json.success === false) {
+        throw new Error(
+          `D1 export API ${response.status}: ${json.errors?.map((e) => e.message).join('; ') ?? 'unknown error'}`,
+        );
+      }
+      return json.result ?? {};
+    };
+
+    try {
+      const bookmark = await step.do('start export', steps.start, async () => {
+        const result = await call({ output_format: 'polling' });
+        if (!result.at_bookmark) {
+          throw new Error('Export did not return a bookmark');
+        }
+        return result.at_bookmark;
+      });
+
+      const databaseKey = await step.do('download and store D1 export', steps.poll, async () => {
+        const result = await call({ output_format: 'polling', current_bookmark: bookmark });
+        if (result.status === 'error') {
+          throw new Error(`Export failed: ${result.error ?? 'unknown'}`);
+        }
+        const file = getD1ExportFile(result);
+        if (!file?.signed_url) {
+          throw new Error('Export not ready yet');
+        }
+        const dump = await fetch(file.signed_url);
+        if (!dump.ok || !dump.body) {
+          throw new Error(`Could not download the export (${dump.status})`);
+        }
+        const objectKey = `${D1_PREFIX}splitpro-${day}-${time}.sql`;
+        await env.BACKUPS.put(objectKey, dump.body, {
+          customMetadata: { bookmark, createdAt: when.toISOString() },
+        });
+        return objectKey;
+      });
+
+      let cursor: string | undefined = undefined;
+      let pageNumber = 0;
+      let uploadsScanned = 0;
+      let uploadsCopied = 0;
+      do {
+        const page = await step.do(`list upload objects ${pageNumber}`, steps.list, async () => {
+          const listed = await env.UPLOADS.list({
+            prefix: '',
+            limit: UPLOADS_PAGE_SIZE,
+            ...(cursor ? { cursor } : {}),
+          });
+          if (listed.truncated && !listed.cursor) {
+            throw new Error('R2 upload listing was truncated without a cursor');
+          }
+          const objects: UploadObjectSummary[] = listed.objects.map(({ key, etag, size }) => ({
+            key,
+            etag,
+            size,
+          }));
+          return {
+            objects,
+            cursor: listed.truncated ? listed.cursor! : null,
+          };
+        });
+
+        const copied = await step.do(`copy upload objects ${pageNumber}`, steps.copy, async () =>
+          copyUploadPage(env.UPLOADS, env.BACKUPS, page.objects),
+        );
+        uploadsScanned += page.objects.length;
+        uploadsCopied += copied;
+        cursor = page.cursor ?? undefined;
+        pageNumber += 1;
+      } while (cursor);
+
+      const manifestKey = await step.do('write backup manifest', steps.store, async () => {
+        const key = `${D1_PREFIX}splitpro-${day}-${time}.json`;
+        const manifest = {
+          version: 1,
+          createdAt: when.toISOString(),
+          database: { key: databaseKey, bookmark },
+          uploads: { prefix: UPLOADS_PREFIX, scanned: uploadsScanned, copied: uploadsCopied },
+        };
+        await env.BACKUPS.put(key, JSON.stringify(manifest, null, 2), {
+          httpMetadata: { contentType: 'application/json' },
+        });
+        return key;
+      });
+
+      const pruned = await step.do('prune old D1 backup artifacts', steps.store, async () => {
+        const cutoff = when.getTime() - retentionDays * 86_400_000;
+        const stale: string[] = [];
+        let pruneCursor: string | undefined;
+        do {
+          const page = await env.BACKUPS.list({ prefix: D1_PREFIX, cursor: pruneCursor });
+          for (const object of page.objects) {
+            if (object.uploaded.getTime() < cutoff) {
+              stale.push(object.key);
+            }
+          }
+          pruneCursor = page.truncated ? page.cursor : undefined;
+        } while (pruneCursor);
+        for (let index = 0; index < stale.length; index += 1000) {
+          await env.BACKUPS.delete(stale.slice(index, index + 1000));
+        }
+        return stale.length;
+      });
+
+      return { databaseKey, manifestKey, uploadsScanned, uploadsCopied, pruned };
+    } catch (error) {
+      logError('workflow', error, { step: 'backup', instanceId: event.instanceId });
+      throw error;
+    }
+  }
+}
diff --git a/src/server/workflows/backupProtocol.ts b/src/server/workflows/backupProtocol.ts
new file mode 100644
index 000000000..1aeac1081
--- /dev/null
+++ b/src/server/workflows/backupProtocol.ts
@@ -0,0 +1,43 @@
+export interface D1ExportFile {
+  filename?: string;
+  signed_url?: string;
+}
+
+export interface D1ExportResult {
+  status?: 'complete' | 'error';
+  at_bookmark?: string;
+  error?: string;
+  result?: D1ExportFile;
+}
+
+export interface D1ExportResponse {
+  success?: boolean;
+  errors?: { message: string }[];
+  result?: D1ExportResult | null;
+}
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  null !== value && 'object' === typeof value;
+
+const isOptionalString = (value: unknown) => undefined === value || 'string' === typeof value;
+
+const isD1ExportFile = (value: unknown): value is D1ExportFile =>
+  isRecord(value) && isOptionalString(value.filename) && isOptionalString(value.signed_url);
+
+const isD1ExportResult = (value: unknown): value is D1ExportResult =>
+  isRecord(value) &&
+  (undefined === value.status || 'complete' === value.status || 'error' === value.status) &&
+  isOptionalString(value.at_bookmark) &&
+  isOptionalString(value.error) &&
+  (undefined === value.result || isD1ExportFile(value.result));
+
+export const isD1ExportResponse = (value: unknown): value is D1ExportResponse =>
+  isRecord(value) &&
+  (undefined === value.success || 'boolean' === typeof value.success) &&
+  (undefined === value.errors ||
+    (Array.isArray(value.errors) &&
+      value.errors.every((error) => isRecord(error) && 'string' === typeof error.message))) &&
+  (undefined === value.result || null === value.result || isD1ExportResult(value.result));
+
+/** The API nests the completed file metadata inside result.result. */
+export const getD1ExportFile = (result: D1ExportResult) => result.result;
diff --git a/src/server/workflows/backupStorage.ts b/src/server/workflows/backupStorage.ts
new file mode 100644
index 000000000..e0258baac
--- /dev/null
+++ b/src/server/workflows/backupStorage.ts
@@ -0,0 +1,51 @@
+const UPLOADS_PREFIX = 'uploads/';
+const COPY_CONCURRENCY = 5;
+
+export interface UploadObjectSummary {
+  key: string;
+  etag: string;
+  size: number;
+}
+
+const copyUploadObject = async (
+  uploads: R2Bucket,
+  backups: R2Bucket,
+  object: UploadObjectSummary,
+) => {
+  const backupKey = `${UPLOADS_PREFIX}${object.key}`;
+  const existing = await backups.head(backupKey);
+  if (existing?.etag === object.etag && existing.size === object.size) {
+    return false;
+  }
+
+  const source = await uploads.get(object.key);
+  if (!source?.body) {
+    throw new Error(`Upload disappeared while backing up: ${object.key}`);
+  }
+
+  const copied = await backups.put(backupKey, source.body, {
+    ...(source.httpMetadata ? { httpMetadata: source.httpMetadata } : {}),
+    ...(source.customMetadata ? { customMetadata: source.customMetadata } : {}),
+  });
+  if (!copied || copied.etag !== source.etag || copied.size !== source.size) {
+    throw new Error(`Could not verify uploaded backup object: ${object.key}`);
+  }
+  return true;
+};
+
+/** Idempotently mirrors one page of uploads while bounding concurrent object streams. */
+export const copyUploadPage = async (
+  uploads: R2Bucket,
+  backups: R2Bucket,
+  objects: UploadObjectSummary[],
+) => {
+  let copied = 0;
+  for (let index = 0; index < objects.length; index += COPY_CONCURRENCY) {
+    const page = objects.slice(index, index + COPY_CONCURRENCY);
+    const results = await Promise.all(
+      page.map((object) => copyUploadObject(uploads, backups, object)),
+    );
+    copied += results.filter(Boolean).length;
+  }
+  return copied;
+};
diff --git a/src/tests/integration/backupProtocol.integration.test.ts b/src/tests/integration/backupProtocol.integration.test.ts
new file mode 100644
index 000000000..d35b2b54d
--- /dev/null
+++ b/src/tests/integration/backupProtocol.integration.test.ts
@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest';
+
+import { getD1ExportFile, isD1ExportResponse } from '~/server/workflows/backupProtocol';
+
+describe('D1 export response', () => {
+  it('reads the signed download URL from the nested completed result', () => {
+    const file = getD1ExportFile({
+      status: 'complete',
+      result: {
+        filename: 'splitpro.sql',
+        signed_url: 'https://example.com/splitpro.sql',
+      },
+    });
+
+    expect(file).toEqual({
+      filename: 'splitpro.sql',
+      signed_url: 'https://example.com/splitpro.sql',
+    });
+  });
+
+  it('returns no file while the export is still running', () => {
+    expect(getD1ExportFile({ at_bookmark: 'bookmark' })).toBeUndefined();
+  });
+
+  it('accepts the complete API response shape and rejects malformed nested file data', () => {
+    expect(
+      isD1ExportResponse({
+        success: true,
+        result: {
+          status: 'complete',
+          result: { filename: 'splitpro.sql', signed_url: 'https://example.com/splitpro.sql' },
+        },
+      }),
+    ).toBe(true);
+    expect(
+      isD1ExportResponse({
+        success: true,
+        result: { status: 'complete', result: { signed_url: 42 } },
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/src/tests/integration/r2Backup.integration.test.ts b/src/tests/integration/r2Backup.integration.test.ts
new file mode 100644
index 000000000..b1c25ad02
--- /dev/null
+++ b/src/tests/integration/r2Backup.integration.test.ts
@@ -0,0 +1,63 @@
+import { env } from 'cloudflare:workers';
+import { describe, expect, it } from 'vitest';
+
+import { copyUploadPage } from '~/server/workflows/backupStorage';
+
+const buckets = env as unknown as { UPLOADS: R2Bucket; BACKUPS: R2Bucket };
+
+describe('R2 upload backup', () => {
+  it('copies upload contents and metadata, skips unchanged objects, and refreshes changed objects', async () => {
+    const key = `backup-test/${crypto.randomUUID()}`;
+    const backupKey = `uploads/${key}`;
+
+    try {
+      await buckets.UPLOADS.put(key, 'first version', {
+        httpMetadata: { contentType: 'text/plain' },
+        customMetadata: { uploadedBy: 'test-user' },
+      });
+      const firstSource = await buckets.UPLOADS.head(key);
+      expect(firstSource).not.toBeNull();
+      if (!firstSource) {
+        throw new Error('Test upload was not stored');
+      }
+
+      expect(
+        await copyUploadPage(buckets.UPLOADS, buckets.BACKUPS, [
+          { key, etag: firstSource.etag, size: firstSource.size },
+        ]),
+      ).toBe(1);
+
+      const firstBackup = await buckets.BACKUPS.get(backupKey);
+      expect(firstBackup?.body).toBeDefined();
+      expect(await firstBackup?.text()).toBe('first version');
+      expect(firstBackup?.httpMetadata?.contentType).toBe('text/plain');
+      expect(firstBackup?.customMetadata).toEqual({ uploadedBy: 'test-user' });
+
+      expect(
+        await copyUploadPage(buckets.UPLOADS, buckets.BACKUPS, [
+          { key, etag: firstSource.etag, size: firstSource.size },
+        ]),
+      ).toBe(0);
+
+      await buckets.UPLOADS.put(key, 'updated version', {
+        httpMetadata: { contentType: 'application/json' },
+      });
+      const updatedSource = await buckets.UPLOADS.head(key);
+      if (!updatedSource) {
+        throw new Error('Updated test upload was not stored');
+      }
+
+      expect(
+        await copyUploadPage(buckets.UPLOADS, buckets.BACKUPS, [
+          { key, etag: updatedSource.etag, size: updatedSource.size },
+        ]),
+      ).toBe(1);
+
+      const updatedBackup = await buckets.BACKUPS.get(backupKey);
+      expect(await updatedBackup?.text()).toBe('updated version');
+      expect(updatedBackup?.httpMetadata?.contentType).toBe('application/json');
+    } finally {
+      await Promise.all([buckets.UPLOADS.delete(key), buckets.BACKUPS.delete(backupKey)]);
+    }
+  });
+});
diff --git a/test/wrangler.test.jsonc b/test/wrangler.test.jsonc
index 4cc58e1a3..765e6e24d 100644
--- a/test/wrangler.test.jsonc
+++ b/test/wrangler.test.jsonc
@@ -11,7 +11,10 @@
       "migrations_dir": "../migrations",
     },
   ],
-  "r2_buckets": [{ "binding": "UPLOADS", "bucket_name": "splitpro-test-uploads" }],
+  "r2_buckets": [
+    { "binding": "UPLOADS", "bucket_name": "splitpro-test-uploads" },
+    { "binding": "BACKUPS", "bucket_name": "splitpro-test-backups" },
+  ],
   "vars": {
     "SKIP_ENV_VALIDATION": "1",
     "NEXTAUTH_URL": "http://localhost:8787",
diff --git a/worker/index.ts b/worker/index.ts
index 656d4ab14..59de7a518 100644
--- a/worker/index.ts
+++ b/worker/index.ts
@@ -11,6 +11,7 @@ import { createRemoteJWKSet, jwtVerify } from 'jose';
 import { logError } from '../src/server/observability/errorLog';
 import { PREVIEW_ACCESS_EMAIL_HEADER, PREVIEW_ACCESS_NAME_HEADER } from '../src/server/preview-access';
 
+export { BackupWorkflow } from '../src/server/workflows/backup';
 export { SchedulerWorkflow } from '../src/server/workflows/scheduler';
 
 addEventListener('unhandledrejection', (event: Event) => {
diff --git a/wrangler.example.jsonc b/wrangler.example.jsonc
index 6f6952bd6..580bd9e7e 100644
--- a/wrangler.example.jsonc
+++ b/wrangler.example.jsonc
@@ -24,10 +24,14 @@
       "binding": "DB",
       "database_name": "splitpro",
       "database_id": "00000000-0000-0000-0000-000000000000",
+      "preview_database_id": "7668fa6d-b120-4025-9bc6-2dae30c83657",
       "migrations_dir": "migrations",
     },
   ],
-  "r2_buckets": [{ "binding": "UPLOADS", "bucket_name": "splitpro-uploads" }],
+  "r2_buckets": [
+    { "binding": "UPLOADS", "bucket_name": "splitpro-uploads" },
+    { "binding": "BACKUPS", "bucket_name": "splitpro-backups" },
+  ],
   "send_email": [{ "name": "EMAIL" }],
   "workflows": [
     {
@@ -38,6 +42,13 @@
       // and (on CLEAR_CACHE_CRON_RULE) clean up cached bank data and currency rates.
       "schedules": ["* * * * *"],
     },
+    {
+      // Daily D1 and R2 uploads backup to the BACKUPS bucket (03:00 UTC).
+      "name": "splitpro-backup",
+      "binding": "BACKUP",
+      "class_name": "BackupWorkflow",
+      "schedules": ["0 3 * * *"],
+    },
   ],
   "vars": {
     "NEXTAUTH_URL": "https://split.example.com",
@@ -51,6 +62,9 @@
     "CACHE_RETENTION_INTERVAL": "2 days",
     "CURRENCY_RATE_PROVIDER": "frankfurter",
     "UPLOAD_MAX_FILE_SIZE_MB": "10",
+    "CF_ACCOUNT_ID": "YOUR_ACCOUNT_ID",
+    "D1_DATABASE_ID": "00000000-0000-0000-0000-000000000000",
+    "BACKUP_RETENTION_DAYS": "90",
   },
   "previews": {
     "vars": {
@@ -62,7 +76,7 @@
       "DISABLE_EMAIL_SIGNUP": "true",
       "INVITE_ONLY": "true",
       "PREVIEW_ACCESS_AUTH": "true",
-      "PREVIEW_ACCESS_AUD": "replace-with-your-access-audience-tag",
+      "PREVIEW_ACCESS_AUD": "29e464ab20d4ba84467f961fdb4051899b486e982836b746a20357503ec86228",
       "CLEAR_CACHE_CRON_RULE": "0 2 * * 0",
       "CACHE_RETENTION_INTERVAL": "2 days",
       "CURRENCY_RATE_PROVIDER": "frankfurter",
@@ -72,7 +86,7 @@
       {
         "binding": "DB",
         "database_name": "splitpro-preview",
-        "database_id": "00000000-0000-0000-0000-000000000000",
+        "database_id": "7668fa6d-b120-4025-9bc6-2dae30c83657",
         "migrations_dir": "migrations",
       },
     ],