diff --git a/templates/backup-cronjob.yaml b/templates/backup-cronjob.yaml
index 13ecfdc..197f77b 100644
--- a/templates/backup-cronjob.yaml
+++ b/templates/backup-cronjob.yaml
@@ -91,7 +91,12 @@ spec:
                 - /bin/sh
                 - -c
                 - |
-                  set -eu
+                  # `pipefail` is critical: without it, a failed
+                  # pg_dump piped into `aws s3 cp` would still produce
+                  # a 0-exit "successful" job (the cp succeeded
+                  # uploading empty/garbage data). With pipefail any
+                  # element of the pipe failing fails the whole thing.
+                  set -euo pipefail
                   TS=$(date -u +%Y%m%dT%H%M%SZ)
                   KEY="${S3_PREFIX}/${TS}.sql.gz"
                   echo ">>> dumping to s3://${S3_BUCKET}/${KEY}"