diff --git a/k8s/overlays/production/kustomization.yaml b/k8s/overlays/production/kustomization.yaml
index e1297ff..a6b1acf 100644
--- a/k8s/overlays/production/kustomization.yaml
+++ b/k8s/overlays/production/kustomization.yaml
@@ -40,9 +40,6 @@ patches:
       - op: add
         path: /spec/volumeName
         value: artista-modelcamp-db-backup-smb
-      - op: replace
-        path: /spec/accessModes
-        value: ["ReadWriteMany"]
   - target: { kind: ConfigMap, name: artista-modelcamp-config }
     patch: |-
       - op: replace
diff --git a/k8s/overlays/production/smb-volumes.yaml b/k8s/overlays/production/smb-volumes.yaml
index 452d3a0..f64551d 100644
--- a/k8s/overlays/production/smb-volumes.yaml
+++ b/k8s/overlays/production/smb-volumes.yaml
@@ -33,11 +33,12 @@ spec:
   persistentVolumeReclaimPolicy: Retain
   storageClassName: ""
   mountOptions:
-    - vers=3.0
+    - vers=3.1.1
+    - seal            # SMB3-Verschluesselung: keine Klartextdaten im Netz
     - uid=1001          # Containerbenutzer "nextjs" (Dockerfile)
     - gid=1001
-    - dir_mode=0770
-    - file_mode=0660
+    - dir_mode=0550     # App liest nur; Schreiben ausschliesslich ueber das NAS
+    - file_mode=0440
     - mfsymlinks
     - nobrl
   csi:
@@ -58,11 +59,13 @@ metadata:
 spec:
   capacity:
     storage: 10Gi
-  accessModes: ["ReadWriteMany"]
+  # ReadWriteOnce: nur der Backup-Job haengt dieses Volume ein.
+  accessModes: ["ReadWriteOnce"]
   persistentVolumeReclaimPolicy: Retain
   storageClassName: ""
   mountOptions:
-    - vers=3.0
+    - vers=3.1.1
+    - seal            # SMB3-Verschluesselung: keine Klartextdaten im Netz
     - uid=70            # Benutzer "postgres" im pg_dump-Job (postgres:18-alpine)
     - gid=70
     - dir_mode=0700     # Sicherungen enthalten personenbezogene Daten