diff --git a/backup-system/clusterrole-backup.yaml b/backup-system/clusterrole-backup.yaml
index 922a3ae..2d3ea45 100644
--- a/backup-system/clusterrole-backup.yaml
+++ b/backup-system/clusterrole-backup.yaml
@@ -13,3 +13,11 @@ rules:
       - get
       - list
       - create
+  # kubectl exec deploy/<nombre> resuelve el Deployment antes de elegir pod
+  - apiGroups: ["apps"]
+    resources:
+      - deployments
+      - statefulsets
+    verbs:
+      - get
+      - list
diff --git a/backup-system/configmap-backup-scripts.yaml b/backup-system/configmap-backup-scripts.yaml
index 6d1d789..b272da2 100644
--- a/backup-system/configmap-backup-scripts.yaml
+++ b/backup-system/configmap-backup-scripts.yaml
@@ -8,6 +8,12 @@ data:
     # (→ alerta Grafana homelab-backup-job-failed → Telegram).
     set -u
 
+    # kubectl usa el ServiceAccount in-cluster (backup-sa + ClusterRole backup-role).
+    # NO usar el k3s.yaml del host: su server es https://127.0.0.1:6443, inalcanzable
+    # desde la red del pod (el script antiguo "funcionaba" porque apuntaba KUBECONFIG
+    # a un fichero inexistente y kubectl caía en fallback al ServiceAccount).
+    unset KUBECONFIG
+
     BACKUP_DIR="/data/backups/backups"
     DATE=$(date +%Y-%m-%d_%H-%M-%S)
     STORAGE=/var/lib/rancher/k3s/storage
diff --git a/backup-system/cronjob-backup.yaml b/backup-system/cronjob-backup.yaml
index 4ed4723..761c49b 100644
--- a/backup-system/cronjob-backup.yaml
+++ b/backup-system/cronjob-backup.yaml
@@ -28,9 +28,6 @@ spec:
             # en Docker Hub ya no son fiables (migración Broadcom/bitnamilegacy)
             image: docker.io/bitnami/kubectl@sha256:558420daf32bbc382e3e9af4537f4073085b336ddd47399a3b70e70087115978
             command: ["/bin/bash", "/scripts/backup.sh"]
-            env:
-            - name: KUBECONFIG
-              value: /kubeconfig/k3s.yaml
             resources:
               requests:
                 cpu: 200m
@@ -49,8 +46,6 @@ spec:
               mountPath: /scripts
             - name: k3s-storage
               mountPath: /var/lib/rancher/k3s/storage
-            - name: kubeconfig
-              mountPath: /kubeconfig/k3s.yaml
             - name: k3s-db
               mountPath: /data/k3s-db
               readOnly: true
@@ -84,10 +79,6 @@ spec:
             hostPath:
               path: /var/lib/rancher/k3s/storage
               type: Directory
-          - name: kubeconfig
-            hostPath:
-              path: /etc/rancher/k3s/k3s.yaml
-              type: File
           - name: k3s-db
             hostPath:
               path: /var/lib/rancher/k3s/server/db