diff --git a/playbooks/ana-docker-backup-repair.yaml b/playbooks/ana-docker-backup-repair.yaml
index 61809de..63660ef 100644
--- a/playbooks/ana-docker-backup-repair.yaml
+++ b/playbooks/ana-docker-backup-repair.yaml
@@ -1,7 +1,13 @@
 steps:
   - name: Preserve the previous hook
     sudo: true
-    shell: cp -p /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
+    # ⚠ -n as well as -p. /etc/restic is 0700 root, so before elway 754db4b
+    # the `creates:` guard evaluated unprivileged, always said "absent", and
+    # this step re-ran on every invocation — a plain `cp -p` would then have
+    # overwritten the preserved ORIGINAL with the current post-repair file,
+    # destroying the one thing the step exists to keep. The guard is fixed,
+    # but a destructive step should not depend on its guard being right.
+    shell: cp -np /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
     creates: /etc/restic/pre-backup.sh.before-repair-20260910
   - name: Install corrected canonical hook
     sudo: true