diff --git a/infra/backup.sh b/infra/backup.sh
index a2c601a..ecf790f 100755
--- a/infra/backup.sh
+++ b/infra/backup.sh
@@ -22,17 +22,19 @@
 
 set -euo pipefail
 
+# ── Load .env ──────────────────────────────────────────────────────────────────
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+ENV_FILE="${SCRIPT_DIR}/../.env"
+if [ -f "$ENV_FILE" ]; then
+    set -a; source "$ENV_FILE"; set +a
+fi
+
 # ── Config ─────────────────────────────────────────────────────────────────────
 HIY_DATA_DIR="${HIY_DATA_DIR:-/data}"
 BACKUP_DIR="${HIY_BACKUP_DIR:-/tmp/hiy-backups}"
 BACKUP_REMOTE="${HIY_BACKUP_REMOTE:-}"
 RETAIN_DAYS="${HIY_BACKUP_RETAIN_DAYS:-30}"
 
-# Load .env from the repo root (one level up from infra/) so the backup cron
-# can find HIY_DATA_DIR, container names, etc. without extra shell setup.
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-ENV_FILE="${SCRIPT_DIR}/../.env"
-
 TIMESTAMP=$(date +%Y%m%d-%H%M%S)
 ARCHIVE_NAME="hiy-backup-${TIMESTAMP}.tar.gz"
 STAGING="${BACKUP_DIR}/staging-${TIMESTAMP}"