diff --git a/review.md b/review.md
index f07101a..735b1d3 100644
--- a/review.md
+++ b/review.md
@@ -5,8 +5,8 @@
 | 1  | Critical | `scripts/deploy.sh`             | `SCRIPT_DIR` resolves to `scripts/` but paths assume repo root (e.g. `$SCRIPT_DIR/caddy/docker-compose.yml`). All scripts broken after move to `scripts/`. Fix: use `REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"` | DONE   |
 | 2  | Critical | `scripts/backup.sh`             | Same broken `SCRIPT_DIR` path issue                                                                                                                                                                                                | DONE   |
 | 3  | Critical | `scripts/restore.sh`            | Same broken `SCRIPT_DIR` path issue                                                                                                                                                                                                | DONE   |
-| 4  | High     | `scripts/backup.sh:20`          | `pg_dumpall -U nextcloud` hardcodes DB username instead of reading from env                                                                                                                                                        | TODO   |
-| 5  | High     | `scripts/restore.sh:68`         | `psql -U nextcloud` hardcodes DB username instead of reading from env                                                                                                                                                              | TODO   |
+| 4  | High     | `scripts/backup.sh:20`          | `pg_dumpall -U nextcloud` hardcodes DB username instead of reading from env                                                                                                                                                        | DONE   |
+| 5  | High     | `scripts/restore.sh:68`         | `psql -U nextcloud` hardcodes DB username instead of reading from env                                                                                                                                                              | DONE   |
 | 6  | High     | `scripts/deploy.sh:13`          | `source .env` in a root-privileged script can execute arbitrary commands. Consider safer parsing or variable validation                                                                                                            | TODO   |
 | 7  | Medium   | `monitoring/docker-compose.yml` | Docker socket + `/proc` + `/sys` + `/` mounted into Alloy container. Consider using a Docker socket proxy to limit API access                                                                                                      | TODO   |
 | 8  | Medium   | `caddy/Caddyfile`               | No rate limiting configured at the reverse proxy layer                                                                                                                                                                             | TODO   |
diff --git a/scripts/backup.sh b/scripts/backup.sh
index 4f9d706..a214099 100755
--- a/scripts/backup.sh
+++ b/scripts/backup.sh
@@ -3,6 +3,7 @@ set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "$REPO_ROOT/.env"
+source "$REPO_ROOT/nextcloud/.env"
 DATA_ROOT="${DATA_ROOT:-/opt/docker-data}"
 
 BACKUP_DIR="/opt/backups"
@@ -17,7 +18,7 @@ echo "==> Starting backup ($DATE)..."
 # Nextcloud Postgres dump
 # ------------------------------------------------------------------
 echo "  -> Dumping Nextcloud Postgres..."
-docker exec nextcloud-postgres pg_dumpall -U nextcloud > "$BACKUP_DIR/nextcloud-db-$DATE.sql"
+docker exec nextcloud-postgres pg_dumpall -U "$POSTGRES_USER" > "$BACKUP_DIR/nextcloud-db-$DATE.sql"
 
 # ------------------------------------------------------------------
 # Nextcloud data
diff --git a/scripts/restore.sh b/scripts/restore.sh
index 28311b7..eaa598b 100755
--- a/scripts/restore.sh
+++ b/scripts/restore.sh
@@ -3,6 +3,7 @@ set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 source "$REPO_ROOT/.env"
+source "$REPO_ROOT/nextcloud/.env"
 DATA_ROOT="${DATA_ROOT:-/opt/docker-data}"
 
 BACKUP_DIR="/opt/backups"
@@ -65,7 +66,7 @@ echo "  -> Waiting for Postgres to be ready..."
 sleep 5
 
 echo "==> Restoring Nextcloud database..."
-docker exec -i nextcloud-postgres psql -U nextcloud < "$DB_DUMP"
+docker exec -i nextcloud-postgres psql -U "$POSTGRES_USER" < "$DB_DUMP"
 
 # ------------------------------------------------------------------
 # Start all services