diff --git a/ansible/tasks/paperless_backup.yml b/ansible/tasks/paperless_backup.yml
index 9e6c581..54f1dbb 100644
--- a/ansible/tasks/paperless_backup.yml
+++ b/ansible/tasks/paperless_backup.yml
@@ -29,6 +29,16 @@
 #
 # IMPORTANT: Also save the restic password in 1Password — lose it and backups are unrecoverable.
 #
+# Optional but recommended: a healthchecks.io dead-man's-switch so a silently
+# broken or unscheduled backup job (e.g. the LaunchAgent never getting loaded)
+# gets flagged, not just script errors. Create a free check at
+# https://healthchecks.io with a 24h period matching the daily 3am schedule
+# (a few hours of grace time), then store its ping URL:
+#
+#   security add-generic-password -a $USER -s paperless-backup-healthcheck-url -w 'https://hc-ping.com/<uuid>'
+#
+# If this isn't set, backup.sh just skips the ping and runs as before.
+#
 # Then initialise the restic repo once:
 #   set -x B2_ACCOUNT_ID (security find-generic-password -a $USER -s paperless-backup-b2-id -w)
 #   set -x B2_ACCOUNT_KEY (security find-generic-password -a $USER -s paperless-backup-b2-key -w)
diff --git a/paperless-ngx/backup.sh b/paperless-ngx/backup.sh
index ba96907..2f1d051 100755
--- a/paperless-ngx/backup.sh
+++ b/paperless-ngx/backup.sh
@@ -11,6 +11,19 @@ log() {
     echo "[$(date '+%Y-%m-%dT%H:%M:%S')] $*" | tee -a "$LOG_FILE"
 }
 
+HEALTHCHECK_PING_URL=$(security find-generic-password -a "$USER" -s paperless-backup-healthcheck-url -w 2>/dev/null || true)
+
+ping_healthcheck() {
+    [ -z "$HEALTHCHECK_PING_URL" ] && return 0
+    curl -fsS -m 10 --retry 3 -o /dev/null "${HEALTHCHECK_PING_URL}${1:-}" || true
+}
+
+on_error() {
+    log "Paperless backup failed"
+    ping_healthcheck /fail
+}
+trap on_error ERR
+
 log "Starting paperless backup"
 
 export B2_ACCOUNT_ID
@@ -34,3 +47,4 @@ log "Pruning old snapshots"
 restic -r b2:mb-paperless-backup:paperless forget --keep-daily 7 --keep-weekly 2 --keep-monthly 2 --prune
 
 log "Paperless backup complete"
+ping_healthcheck