diff --git a/Chart.yaml b/Chart.yaml
index 9ce7869..49e0d03 100644
--- a/Chart.yaml
+++ b/Chart.yaml
@@ -5,7 +5,7 @@ description: |
   Variation between instances is expressed via values.yaml only.
   No chart variants. No string-templating in Tower.
 type: application
-version: 0.1.12
+version: 0.1.13
 appVersion: "1.0"
 keywords:
   - odoo
diff --git a/templates/backup-cronjob.yaml b/templates/backup-cronjob.yaml
index ad19958..1ed67a6 100644
--- a/templates/backup-cronjob.yaml
+++ b/templates/backup-cronjob.yaml
@@ -103,7 +103,15 @@ spec:
                       name: {{ .Values.backups.credentialsSecret }}
                       key: AWS_SECRET_ACCESS_KEY
                 - name: S3_ENDPOINT
-                  value: {{ .Values.backups.s3.endpoint | quote }}
+                  # Normalize: awscli's --endpoint-url requires a scheme
+                  # ("scheme is missing. Must be of the form http://...").
+                  # Tower's migrate path historically emitted bare
+                  # `s3-cn-gd.ufileos.com` for CN tenants, which booted
+                  # every backup pod into Error within seconds. Prepend
+                  # https:// when the operator-supplied value omits a
+                  # scheme so the chart is resilient to either shape.
+                  # Closes docs/architecture/2026-05-27-migrate-cn-parity.md Bug #4.
+                  value: {{ if hasPrefix "http" .Values.backups.s3.endpoint }}{{ .Values.backups.s3.endpoint | quote }}{{ else }}{{ printf "https://%s" .Values.backups.s3.endpoint | quote }}{{ end }}
                 - name: AWS_DEFAULT_REGION
                   value: {{ .Values.backups.s3.region | quote }}
                 - name: S3_BUCKET