diff --git a/docs/deployment/hetzner-server-setup.md b/docs/deployment/hetzner-server-setup.md
index aab36c10..8402de3e 100644
--- a/docs/deployment/hetzner-server-setup.md
+++ b/docs/deployment/hetzner-server-setup.md
@@ -84,11 +84,11 @@ Complete step-by-step guide for deploying Orion on a Hetzner Cloud VPS.
         - `https://rewardflow.lu` (Loyalty+)
     - Platform `domain` column updated in production DB
     - RAM usage ~2.4 GB on 4 GB server (stable, CI jobs add ~550 MB temporarily)
+    - **Systemd backup timer** (`orion-backup.timer`) — daily at 03:00 UTC, tested manually
+    - **Cloudflare R2 offsite backups** — `orion-backups` bucket, `awscli` configured with `--profile r2`, `--upload` flag added to systemd timer
+    - `python3-pip` and `awscli` installed on server (pip user install, PATH added to `.bashrc` and systemd service)
 
-    **Remaining:**
-
-    - [ ] Cloudflare R2 offsite backup setup (create account + bucket, configure `awscli`, add `--upload` to systemd timer)
-    - [ ] Systemd backup timer (`orion-backup.timer`) — daily at 03:00
+    **Steps 1–18 fully complete.** All infrastructure operational.
 
 
 ## Installed Software Versions
@@ -835,7 +835,14 @@ R2 provides S3-compatible object storage with a generous free tier (10 GB storag
 **Install and configure AWS CLI on the server:**
 
 ```bash
-sudo apt install -y awscli
+# awscli is not available via apt on Ubuntu 24.04; install via pip
+sudo apt install -y python3-pip
+pip3 install awscli --break-system-packages
+
+# Add ~/.local/bin to PATH (pip installs binaries there)
+echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
+source ~/.bashrc
+
 aws configure --profile r2
 # Access Key ID: <from step 5>
 # Secret Access Key: <from step 5>
@@ -896,7 +903,8 @@ After=docker.service
 [Service]
 Type=oneshot
 User=samir
-ExecStart=/usr/bin/bash /home/samir/apps/orion/scripts/backup.sh
+Environment="PATH=/home/samir/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+ExecStart=/usr/bin/bash /home/samir/apps/orion/scripts/backup.sh --upload
 StandardOutput=journal
 StandardError=journal
 ```