/var/lib/ci/backups was root:root because ci-backup-template.service runs as root and mkdir(exist_ok=True) created it before ci-runner ever touched it, so every 7z backup failed with errno=13. Chown to ci-runner:ci-runner + 750, and stop the drift from coming back: the setup script now creates+chmods the dir, and the systemd unit gets an ExecStartPre that (re)installs it with the right owner on every start.