@@ -121,7 +121,7 @@ When `useSystemBucket: true`:
 
 Because the chart drops `spec.backup.tasks` and `spec.backup.pitr`, the psmdb operator's own scheduled backups and oplog PITR do **not** run on this flow — `backup.schedule` and `backup.retentionPolicy` stay in the schema for the default flow but have no effect here, and the `recoveryTime` PITR restores described below are not available. Migrate scheduled backups to a `backups.cozystack.io/Plan` against `cozy-default` instead. **Flipping this flag on a running app** removes the storage, tasks and pitr the app had, so a release that was taking scheduled backups + PITR before the flip stops until a `Plan` takes over.
 
-Dropping `spec.backup.tasks` also drops the psmdb `keep` retention it carried, so on this flow **the driver owns the archive** the way the Rabbitmq/Redis drivers own theirs (an on-demand `PerconaServerMongoDBBackup` is not covered by psmdb task retention). The driver stamps the operator's `percona.com/delete-backup` finalizer onto each backup it mints here, and deleting a Cozystack `Backup` (a retention-pruned `Plan`, or a manual delete) deletes that `PerconaServerMongoDBBackup` CR — whose finalizer removes the pbm object from the shared bucket before the `Backup` is released, so a Plan does not accumulate objects in `cozy-backups`. A legacy backup writes to the tenant's own bucket and keeps the pre-existing hands-off contract (its lifecycle stays the tenant's / operator's; nothing is deleted on `Backup` removal). Note this prunes only when a `Backup` is deleted: unlike CNPG and MariaDB, which prune engine-side on their own schedule, MongoDB has no engine-side scheduled trim on this flow, so keeping `cozy-backups` bounded depends on a `Plan`'s retention actually deleting old `Backup` objects (scheduled retention at the `Plan` level is tracked as future work). Two cases release the `Backup` without waiting for the object to be pruned, so a wedged prune never pins a namespace in `Terminating`: a terminating namespace (where the operator's delete-backup step cannot run) and the `backups.cozystack.io/skip-artifact-cleanup: "true"` annotation. In both the driver strips its own finalizer and leaves the object for a bucket lifecycle policy to reclaim. A down operator or unreachable storage in a live namespace is NOT released automatically — the `Backup` stays `Terminating` as a visible signal until the operator recovers or you set that annotation to force the release.
+Dropping `spec.backup.tasks` also drops the psmdb `keep` retention it carried, so on this flow **the driver owns the archive** the way the Rabbitmq/Redis drivers own theirs (an on-demand `PerconaServerMongoDBBackup` is not covered by psmdb task retention). The driver stamps the operator's `percona.com/delete-backup` finalizer onto each backup it mints here, and deleting a Cozystack `Backup` (a retention-pruned `Plan`, or a manual delete) deletes that `PerconaServerMongoDBBackup` CR — whose finalizer removes the pbm object from the shared bucket before the `Backup` is released, so a Plan does not accumulate objects in `cozy-backups`. A legacy backup writes to the tenant's own bucket and keeps the pre-existing hands-off contract (its lifecycle stays the tenant's / operator's; nothing is deleted on `Backup` removal). Note this prunes only when a `Backup` is deleted: unlike CNPG and MariaDB, which prune engine-side on their own schedule, MongoDB has no engine-side scheduled trim on this flow, so keeping `cozy-backups` bounded depends on a `Plan`'s retention actually deleting old `Backup` objects. **A `Plan` has no retention field yet** (`PlanSpec` carries only `applicationRef`, `backupClassName` and `schedule`), so today a nightly `useSystemBucket` Plan grows the shared bucket unbounded — `schedule` and `retentionPolicy` on the app are inert here (see [MongoDB: opt-in to the system bucket](#mongodb-backup-storage)), and platform-level retention is tracked in the [`BackupRetentionPolicy` design (#4192)](https://github.com/cozystack/cozystack/pull/4192). Teardown GC of orphaned `Backup`s / S3 data is [#3966](https://github.com/cozystack/cozystack/issues/3966). Until those land, bound `cozy-backups` with an S3 lifecycle policy on the object store. Two cases release the `Backup` without waiting for the object to be pruned, so a wedged prune never pins a namespace in `Terminating`: a terminating namespace (where the operator's delete-backup step cannot run) and the `backups.cozystack.io/skip-artifact-cleanup: "true"` annotation. In both the driver strips its own finalizer and leaves the object for a bucket lifecycle policy to reclaim. A down operator or unreachable storage in a live namespace is NOT released automatically — the `Backup` stays `Terminating` as a visible signal until the operator recovers or you set that annotation to force the release.
 
 **Opting back out** (`useSystemBucket` true→false) is not automatic in reverse: the driver stops injecting, but the `s3-storage` entry it already applied stays on the live `PerconaServerMongoDB` under the driver's own field manager (`cozystack-psmdb-backup-driver`) — the chart does not own it and so never prunes it. It is inert once `backup.enabled=false`; to fully return a release to the legacy flow, delete that storage entry from the `PerconaServerMongoDB` by hand before re-declaring the tenant's own `backup.*` S3 values.
 
 
@@ -348,6 +348,22 @@ func (r *BackupJobReconciler) reconcileMongoDB(ctx context.Context, j *backupsv1
 		// BackupJob Running forever), but a running dump is left to finish rather
 		// than stranding its archive — see psmdbBackupTimedOut.
 		if psmdbBackupTimedOut(state, j.Status.StartedAt) {
+			// Cancel the operator CR before failing. A `waiting` backup is queued
+			// behind another and the operator starts it once the slot frees — which
+			// would be after this BackupJob is Failed and never reconciled again,
+			// writing an archive into the shared bucket that no Backup object
+			// represents. Deleting the CR now prevents that late run; on the
+			// useSystemBucket flow its delete-backup finalizer also takes anything
+			// partially written. Best-effort: a delete failure must not stop the
+			// job from failing (a leftover CR is the pre-existing behaviour, not a
+			// regression). The terminal Phase=Failed makes reconcileMongoDB return
+			// early next time, so ensureMongoDBBackup never re-creates it.
+			if mdbBackup.DeletionTimestamp.IsZero() {
+				if derr := r.Delete(ctx, mdbBackup); derr != nil && !apierrors.IsNotFound(derr) {
+					getLogger(ctx).Debug("could not cancel the timed-out operator backup before failing",
+						"backupjob", j.Name, "sourceBackup", mdbBackup.Name, "error", derr)
+				}
+			}
 			detail := "no state observed"
 			if state != "" {
 				detail = fmt.Sprintf("state=%s", state)
@@ -575,9 +591,11 @@ func psmdbBackupDeadlineExceeded(startedAt *metav1.Time) bool {
 // (the operator CR carries no ownerRef either). A real dataset routinely outruns
 // 30m, and a genuinely broken dump terminates through the operator's own
 // error/rejected state, so a running backup is left to finish. The deadline
-// still bounds the case it was written for — the operator never starts the
-// backup (state stays "", requested or waiting), where nothing has been written
-// and failing strands nothing.
+// still bounds the case it was written for — the operator has not started the
+// backup (state stays "", requested or waiting), where nothing has been written.
+// A `waiting` backup (queued behind another) could still be started later, so
+// the caller cancels the operator CR when this trips, rather than leaving it to
+// run into the shared bucket after the BackupJob is already Failed.
 func psmdbBackupTimedOut(state string, startedAt *metav1.Time) bool {
 	if state == psmdbtypes.StateRunning {
 		return false
 
@@ -1234,6 +1234,54 @@ func mongodbInjectFixture(enabled bool) (*backupsv1alpha1.BackupJob, *strategyv1
 	return job, strategy, app, cluster, resolved
 }
 
+// When a backup the operator never started (state=waiting, queued behind
+// another) trips the deadline, the driver must cancel the operator CR before
+// failing the BackupJob — otherwise the operator starts it later and writes an
+// archive into the shared bucket that no Backup object represents.
+func TestReconcileMongoDB_TimedOutBackupIsCancelled(t *testing.T) {
+	job, strategy, app, cluster, resolved := mongodbInjectFixture(true)
+	// The BackupJob started well past the deadline.
+	old := &metav1.Time{Time: time.Now().Add(-2 * psmdbDefaultBackupDeadline)}
+	job.Status.StartedAt = old
+	// An operator backup already exists for this job, queued (state=waiting), with
+	// the delete-backup finalizer the useSystemBucket flow stamps.
+	opBackup := &psmdbtypes.PerconaServerMongoDBBackup{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:  "tenant",
+			Name:       "op-waiting",
+			Finalizers: []string{psmdbDeleteBackupFinalizer},
+			Labels: map[string]string{
+				backupsv1alpha1.OwningJobNameLabel:      job.Name,
+				backupsv1alpha1.OwningJobNamespaceLabel: job.Namespace,
+			},
+		},
+		Status: psmdbtypes.PerconaServerMongoDBBackupStatus{State: psmdbtypes.StateWaiting},
+	}
+
+	c := newMongoDBStrategyTestClient(t, job, strategy, app, cluster, opBackup)
+	r := &BackupJobReconciler{Client: c, Scheme: c.Scheme()}
+
+	if _, err := r.reconcileMongoDB(context.Background(), job.DeepCopy(), resolved); err != nil {
+		t.Fatalf("reconcileMongoDB: %v", err)
+	}
+
+	// The operator CR must be cancelled (deleted): with the finalizer it stays
+	// Terminating, so assert a DeletionTimestamp; without the fix it is untouched.
+	got := &psmdbtypes.PerconaServerMongoDBBackup{}
+	err := c.Get(context.Background(), types.NamespacedName{Namespace: "tenant", Name: "op-waiting"}, got)
+	if err == nil && got.DeletionTimestamp.IsZero() {
+		t.Errorf("timed-out operator backup must be cancelled (deleted) so it cannot run later; it was left untouched")
+	}
+	// And the BackupJob is failed.
+	persisted := &backupsv1alpha1.BackupJob{}
+	if err := c.Get(context.Background(), types.NamespacedName{Namespace: "tenant", Name: job.Name}, persisted); err != nil {
+		t.Fatalf("get job: %v", err)
+	}
+	if persisted.Status.Phase != backupsv1alpha1.BackupJobPhaseFailed {
+		t.Errorf("expected the BackupJob to be Failed, got phase=%q", persisted.Status.Phase)
+	}
+}
+
 // A cluster that can never service a backup (backup.enabled=false) must not be
 // mutated: injection is gated on Enabled so the disabled cluster fails the
 // precondition on the enabled check without the driver having written storage
 
@@ -217,18 +217,6 @@ spec:
     {{- end }}
   {{- end }}
 
-  {{- /*
-    useSystemBucket cannot honour backup.retentionPolicy: the tasks[].keep block
-    below (the chart's only retention) is gated out on this flow, and no
-    Plan-level retention exists yet, so a retentionPolicy set here would silently
-    grow the shared cozy-backups bucket. Reject a value the tenant changed from
-    the chart default rather than ignore it — an untouched useSystemBucket install
-    keeps rendering. $defaultRetentionPolicy MUST track the values.yaml default.
-  */}}
-  {{- $defaultRetentionPolicy := "30d" }}
-  {{- if and .Values.backup.useSystemBucket .Values.backup.retentionPolicy (ne .Values.backup.retentionPolicy $defaultRetentionPolicy) }}
-  {{- fail (printf "backup.retentionPolicy=%q cannot be honoured when backup.useSystemBucket=true: the platform flow has no engine-side retention and Plan-level retention is not yet available (see docs/operations/backup-classes.md). Remove backup.retentionPolicy, or drive scheduled backups and retention through a backups.cozystack.io/Plan." .Values.backup.retentionPolicy) }}
-  {{- end }}
   backup:
     enabled: {{ .Values.backup.enabled | default false }}
     image: percona/percona-backup-mongodb:2.11.0
 
@@ -93,10 +93,10 @@ tests:
           path: spec.backup.pitr
         documentIndex: 0
 
-  - it: rejects a non-default retentionPolicy on useSystemBucket
-    # The platform flow cannot honour retentionPolicy (no engine-side trim, no
-    # Plan retention yet), so a value the tenant changed from the default is a
-    # hard error rather than a silent no-op that grows the shared bucket.
+  - it: ignores retentionPolicy and schedule on useSystemBucket (renders, no tasks)
+    # On this flow retentionPolicy and schedule are inert (documented as ignored),
+    # handled the same way: a custom value renders cleanly without emitting the
+    # tasks block, never a hard render error.
     release:
       name: test-mongodb
       namespace: tenant-test
@@ -107,28 +107,15 @@ tests:
         enabled: true
         useSystemBucket: true
         retentionPolicy: 7d
-    asserts:
-      - failedTemplate:
-          errorMessage: 'backup.retentionPolicy="7d" cannot be honoured when backup.useSystemBucket=true: the platform flow has no engine-side retention and Plan-level retention is not yet available (see docs/operations/backup-classes.md). Remove backup.retentionPolicy, or drive scheduled backups and retention through a backups.cozystack.io/Plan.'
-
-  - it: allows the default retentionPolicy on useSystemBucket
-    # The untouched default must still render, so the guard only fires on a
-    # tenant-changed value (this pins the discriminator, not just the reject).
-    release:
-      name: test-mongodb
-      namespace: tenant-test
-    set:
-      _cluster:
-        cluster-domain: cozy.local
-      backup:
-        enabled: true
-        useSystemBucket: true
-        retentionPolicy: 30d
+        schedule: "0 5 * * *"
     asserts:
       - equal:
           path: spec.backup.enabled
           value: true
         documentIndex: 0
+      - notExists:
+          path: spec.backup.tasks
+        documentIndex: 0
 
   ##################
   # Finalizers     #