diff --git a/apps/api/src/services/incident_service.py b/apps/api/src/services/incident_service.py
index f9fc4373..03b12962 100644
--- a/apps/api/src/services/incident_service.py
+++ b/apps/api/src/services/incident_service.py
@@ -164,8 +164,19 @@ def classify_alert_early(alertname: str, severity: str, labels: dict | None = No
         return "info", "TYPE-1"
 
     # 5. Backup / Heartbeat — 純資訊，不進 LLM
-    # VeleroBackup 由 K8s prefix 規則接管，此處只攔 watchdog/heartbeat
-    if "watchdog" in alertname_lower or alertname == "Heartbeat":
+    # HostBackupFailed 必須在 Host prefix 前攔截，否則被歸 host_resource/TYPE-3
+    # 2026-04-12 ogt: 只針對已知主機備份監控 alertname，不用寬泛關鍵字
+    # BackupJobFailed severity=warning 仍走 TYPE-3（見測試 test_backup_keyword_warning_not_type1）
+    _BACKUP_TYPE1_NAMES = {
+        "HostBackupFailed", "HostBackupStale", "HostBackupMissing",
+        "BackupRestoreTestFailed", "BackupRestoreTestStale",
+    }
+    if (
+        "watchdog" in alertname_lower
+        or alertname == "Heartbeat"
+        or alertname in _BACKUP_TYPE1_NAMES
+        or alertname.startswith("HostBackup")
+    ):
         return "backup", "TYPE-1"
 
     # 6. 主機資源（從 infrastructure 分離，ADR-075 統帥決議）