diff --git a/deploy-k3s/manifests/worker/deployment.yaml b/deploy-k3s/manifests/worker/deployment.yaml
index f08e0cb..ca6b887 100644
--- a/deploy-k3s/manifests/worker/deployment.yaml
+++ b/deploy-k3s/manifests/worker/deployment.yaml
@@ -74,6 +74,21 @@ spec:
                   name: honeydue-secrets
                   key: REDIS_PASSWORD
                   optional: true
+            # B2 (Backblaze) credentials. The worker needs these to delete
+            # B2 objects when the pending_uploads cleanup cron reaps
+            # expired upload sessions. Without them the worker falls back
+            # to local-disk storage which fails on this pod's read-only
+            # root filesystem and disables the cleanup cron.
+            - name: B2_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: honeydue-secrets
+                  key: B2_KEY_ID
+            - name: B2_APP_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: honeydue-secrets
+                  key: B2_APP_KEY
             # Observability — workers emit traces (e.g., asynq job spans) to
             # obs.88oakapps.com over OTLP/HTTP. service.name=honeydue-worker
             # so api and worker show up as separate services in Jaeger.