diff --git a/ansible/roles/podman/tasks/containers/cloud-backup.yml b/ansible/roles/podman/tasks/containers/cloud-backup.yml
index 40fb012..780f6dd 100644
--- a/ansible/roles/podman/tasks/containers/cloud-backup.yml
+++ b/ansible/roles/podman/tasks/containers/cloud-backup.yml
@@ -18,6 +18,18 @@
     mode: 0600
     setype: ssh_home_t
 
+# A direct host-to-S3 stage was added here and then removed. Offsite already
+# happens: the TrueNAS rsync below feeds /mnt/glacier/skudakcloud, and a
+# TrueNAS cloud-sync task pushes that to Skudak's own iDrive e2 bucket. A
+# second, direct push would have written the same data into the same bucket
+# twice. If offsite is ever moved onto this host, it should REPLACE the rsync
+# rather than run alongside it.
+- name: remove obsolete backup S3 credentials
+  become: true
+  ansible.builtin.file:
+    path: "/etc/backup_s3/{{ backup_name }}"
+    state: absent
+
 - name: template {{ backup_name }} backup script
   become: true
   ansible.builtin.template:
diff --git a/ansible/roles/podman/templates/nextcloud/cloud-backup.sh.j2 b/ansible/roles/podman/templates/nextcloud/cloud-backup.sh.j2
index 2987e8c..433b36b 100644
--- a/ansible/roles/podman/templates/nextcloud/cloud-backup.sh.j2
+++ b/ansible/roles/podman/templates/nextcloud/cloud-backup.sh.j2
@@ -171,5 +171,4 @@ log "syncing db dumps"
 rsync -az --timeout=600 --delete --mkpath {{ backup_rsync_extra_args | default('') }} \
   -e "$SSH" "$STAGE/db/" "$DEST:{{ remote_path }}/_backup/db/"
 {% endif %}
-
 log "status=ok"