diff --git a/.dockerignore b/.dockerignore
index d241d517..45e7873e 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -22,9 +22,13 @@
 # scripts/ 大部分不需要進 image，僅白名單 production runtime/ops 種子腳本
 # 2026-04-12 ogt (ADR-073 P2-1): 白名單允許 cron_km_vectorize.py
 # 2026-05-13 codex: 白名單 T16 auto-repair canary PlayBook seed script
+# 2026-05-31 codex: MOMO backup Ansible playbook copies the backup script from
+# the controller image; keep only this backup script in the runtime context.
 scripts/**
 !scripts/
 !scripts/cron_km_vectorize.py
+!scripts/backup/
+!scripts/backup/backup-momo-188-pg.sh
 !scripts/ops/
 !scripts/ops/awooop-seed-auto-repair-canary-playbook.py
 
diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 50ce2c52..357fd54b 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -19,6 +19,8 @@ on:
       - '.dockerignore'
       # Dockerfile COPY scripts/ into the API image; keep production ops
       # seed scripts deploy-coupled instead of repo-only.
+      - 'scripts/backup/backup-momo-188-pg.sh'
+      - 'scripts/ops/notify-awoooi-ops.sh'
       - 'scripts/ops/awooop-seed-auto-repair-canary-playbook.py'
       # Workflow-only changes do not rebuild runtime images. Use workflow_dispatch
       # when an operator explicitly wants to test the CD pipeline itself.