diff --git a/dashcaddy-api/routes/backups.js b/dashcaddy-api/routes/backups.js
index b870e56..ae79e5a 100644
--- a/dashcaddy-api/routes/backups.js
+++ b/dashcaddy-api/routes/backups.js
@@ -484,7 +484,14 @@ module.exports = function({ backupManager, licenseManager, asyncHandler }) {
 
   // Update backup configuration
   router.post('/backups/config', asyncHandler(async (req, res) => {
-    backupManager.updateConfig(req.body);
+    // P0-3 fix: was `backupManager.updateConfig(req.body)` which allowed
+    // arbitrary keys from HTTP request body to be merged into persisted config.
+    // Now destructure only the two known top-level fields.
+    const { backups, defaultRetention } = req.body || {};
+    const patch = {};
+    if (backups !== undefined) patch.backups = backups;
+    if (defaultRetention !== undefined) patch.defaultRetention = defaultRetention;
+    backupManager.updateConfig(patch);
     success(res, { message: 'Backup configuration updated' });
   }, 'backups-config-update'));