diff --git a/deploy/systemd/ci-backup-template.service b/deploy/systemd/ci-backup-template.service
index 7dbcc48..5575011 100644
--- a/deploy/systemd/ci-backup-template.service
+++ b/deploy/systemd/ci-backup-template.service
@@ -8,6 +8,13 @@ Type=oneshot
 User=root
 EnvironmentFile=/etc/ci/environment
 WorkingDirectory=/opt/ci/local-ci-cd-system
+# This service runs as root (to restart act-runner.service via ExecStopPost),
+# but the backups dir is shared with ci-web.service, which runs as ci-runner
+# and offers a manual "backup template" action. Guarantee the dir exists owned
+# by ci-runner *before* the root-owned backup writes into it, otherwise a first
+# root run would create /var/lib/ci/backups as root:root and lock ci-runner
+# (the web UI) out with errno=13. Idempotent; -o/-g re-assert ownership.
+ExecStartPre=/usr/bin/install -d -o ci-runner -g ci-runner -m 750 /var/lib/ci/backups
 # --keep-count 1: three generations of Windows templates cost ~195 GB and the
 # archives were byte-identical between runs (the templates rarely change), so
 # the extra generations bought nothing. --exclude WinBuildTest: retired test
diff --git a/setup-host-linux.sh b/setup-host-linux.sh
index 324ff94..c27867f 100755
--- a/setup-host-linux.sh
+++ b/setup-host-linux.sh
@@ -196,13 +196,13 @@ for pkg in p7zip-full xorriso genisoimage; do
 done
 
 mkdir -p \
-    "$CI_ROOT"/{build-vms,artifacts,templates,keys,logs,runner,iso} \
+    "$CI_ROOT"/{build-vms,artifacts,templates,backups,keys,logs,runner,iso} \
     "$OPT_CI" \
     /etc/ci/keys
 
 chown -R "$CI_USER:$CI_USER" "$CI_ROOT" "$OPT_CI"
 chmod 750 "$CI_ROOT" "$OPT_CI"
-for d in build-vms artifacts templates keys logs runner iso; do
+for d in build-vms artifacts templates backups keys logs runner iso; do
     chmod 750 "$CI_ROOT/$d"
 done
 chmod 700 /etc/ci/keys