diff --git a/stacks/backup/README.md b/stacks/backup/README.md
index 68a4cb0..0bab4ae 100644
--- a/stacks/backup/README.md
+++ b/stacks/backup/README.md
@@ -24,7 +24,7 @@ Kopia → Backblaze B2. Backs up `/config`, **selected** `labdata` paths (see `S
 
 ## After deploy
 
-- UI: `http://valhalla:51515` (or add `backup.ginnoir.com` internal-only in Caddy)
+- UI: https://backup.ginnoir.com (LAN/Tailscale) — username `kopia`, password = `KOPIA_REPOSITORY_PASSWORD` in `stack.env`
 - Subscribe phone to ntfy topic `backup` (or path in `NTFY_URL`)
 - **Restore test** (do once): pick a small dump from `/config/backup/dumps/`, restore to a throwaway container
 
diff --git a/stacks/backup/init-kopia.sh b/stacks/backup/init-kopia.sh
index 89ce42b..5115c06 100644
--- a/stacks/backup/init-kopia.sh
+++ b/stacks/backup/init-kopia.sh
@@ -44,4 +44,7 @@ else
   echo "init-kopia: B2 credentials empty — start UI only; configure repo manually (see README)"
 fi
 
-exec kopia server start --ui --insecure --address=0.0.0.0:51515
+# Web UI uses HTTP basic auth (distinct from repository encryption password).
+exec kopia server start --ui --insecure --address=0.0.0.0:51515 \
+  --server-username=kopia \
+  --server-password="${KOPIA_PASSWORD}"