diff --git a/app/sbin/backup/ODOO_19 b/app/sbin/backup/ODOO_19
index 1e2dd70..32b66a1 100755
--- a/app/sbin/backup/ODOO_19
+++ b/app/sbin/backup/ODOO_19
@@ -1,46 +1,56 @@
 #!/bin/bash
-# Backup Odoo database script
-# Author: Your Name
-# Description: Dumps Odoo DB, manages backups, and sets permissions
+# Backup Odoo 19 database script
+# Description: Dumps Odoo DB, manages backup rotation, and maintains a current.zip symlink
 
 set -euo pipefail  # Fail on error, undefined variables, and pipe errors
 
+log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }
+
 # Load helper functions
 source /4server/sbin/helpers
 
-# Get contract info
+# Get contract info (also exports ODOO_DB_PASSWORD via helpers)
 get_contract_info
 
-# Export Odoo database password
-export ODOO_DB_PASSWORD
-#ODOO_DB_PASSWORD=$(echo "$SECRET" | jq -r '.psql')
+log "UUID:         $UUID"
+log "Backup slots: $BACKUP_SLOTS"
+log "DB host:      $POSTGRES_HOST"
 
-# Display basic info
-echo "UUID: $UUID"
-echo "Backup slots: $BACKUP_SLOTS"
-
-# Create backup filename
+# Build paths
 FILENAME="$(date +"%Y%m%d_%H%M").zip"
 BACKUP_DIR="/BACKUP/$UUID"
 
-# Ensure backup directory exists
-mkdir -p "$BACKUP_DIR"
+# Ensure backup directory exists (requires elevated permissions like other ops)
+doas mkdir -p "$BACKUP_DIR"
 
-# Perform database dump using docker
+# Perform database dump inside the container
+log "Starting dump -> $BACKUP_DIR/$FILENAME"
 doas docker exec "$UUID" odoo db \
-    --db_host beedb \
+    --db_host "$POSTGRES_HOST" \
     -r "$UUID" \
     -w "$ODOO_DB_PASSWORD" \
     --data-dir /home/odoo/.local/share/Odoo/ \
     dump "$UUID" "/mnt/backup/$FILENAME"
 
-# Set permissions for backup files
-doas chmod 600 "$BACKUP_DIR"/*
+log "Dump complete: $(doas du -sh "$BACKUP_DIR/$FILENAME" | cut -f1)"
+
+# Secure timestamped backups (scoped glob — leaves current.zip symlink untouched)
+doas chmod 600 "$BACKUP_DIR"/[0-9]*.zip
+
+# Hand ownership back to odoo inside the container
 doas docker exec "$UUID" chown odoo:odoo -R /mnt/backup
 
+# Update the current.zip symlink to point at the backup just created
+# ln -sf uses a relative target so the symlink stays valid if the dir is moved
+doas ln -sf "$FILENAME" "$BACKUP_DIR/current.zip"
+log "current.zip -> $FILENAME"
 
-# Remove old backups beyond the configured slots
-ls -t "$BACKUP_DIR"/[0-9]*.zip 2>/dev/null | tail -n +$((BACKUP_SLOTS + 1)) | while read -r file; do
-    echo "Deleting old backup: $file"
-    doas rm -f "$file"
-done
+# Remove old backups beyond the configured slot count
+# Process substitution (< <(...)) keeps the loop in the main shell so
+# set -e / exit codes propagate correctly — unlike a pipe subshell.
+while IFS= read -r old_file; do
+    log "Deleting old backup: $old_file"
+    doas rm -f "$old_file"
+done < <(ls -t "$BACKUP_DIR"/[0-9]*.zip 2>/dev/null | tail -n +$((BACKUP_SLOTS + 1)))
+
+log "Backup finished successfully."