diff --git a/deploy-k3s/manifests/api/deployment.yaml b/deploy-k3s/manifests/api/deployment.yaml
index ec1a8f7..c79e593 100644
--- a/deploy-k3s/manifests/api/deployment.yaml
+++ b/deploy-k3s/manifests/api/deployment.yaml
@@ -73,6 +73,21 @@ spec:
                   name: honeydue-secrets
                   key: REDIS_PASSWORD
                   optional: true
+            # B2 (Backblaze) credentials. With both set, StorageConfig.IsS3()
+            # returns true and uploads stream to B2 via minio-go. With either
+            # missing, code falls back to local filesystem — and since
+            # readOnlyRootFilesystem is true on this container, that fallback
+            # silently fails. So both must be wired or uploads break.
+            - name: B2_KEY_ID
+              valueFrom:
+                secretKeyRef:
+                  name: honeydue-secrets
+                  key: B2_KEY_ID
+            - name: B2_APP_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: honeydue-secrets
+                  key: B2_APP_KEY
           volumeMounts:
             - name: apns-key
               mountPath: /secrets/apns