diff --git a/infra/docker-compose.nas.yml b/infra/docker-compose.nas.yml
index b16881a..bd754fd 100644
--- a/infra/docker-compose.nas.yml
+++ b/infra/docker-compose.nas.yml
@@ -50,6 +50,47 @@ services:
       com.vignette.data-role: database-ssot
     networks: [backend]
 
+  db-backup:
+    # 매일 검증형 custom dump를 ./backups/auto 에 원자적으로 남기고 보존기간을 넘긴
+    # 파일만 지운다. DB에는 읽기만 수행하며 실패 시 해당 회차 파일을 남기지 않는다.
+    image: ${VIGNETTE_NAS_POSTGRES_IMAGE:?Immutable NAS PostgreSQL image ID is required}
+    restart: unless-stopped
+    depends_on:
+      db: { condition: service_healthy }
+    entrypoint:
+      - sh
+      - -ceu
+      - |
+        while true; do
+          ts=$$(date +%Y%m%d-%H%M%S)
+          tmp="/backups/auto/.partial-$${ts}.dump"
+          out="/backups/auto/vignette-$${ts}.dump"
+          if PGPASSWORD="$${POSTGRES_PASSWORD}" pg_dump -h db -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}" -Fc -f "$$tmp" \
+             && PGPASSWORD="$${POSTGRES_PASSWORD}" pg_restore -l "$$tmp" > /dev/null; then
+            mv "$$tmp" "$$out"
+            echo "backup ok: $$out ($$(wc -c < "$$out") bytes)"
+          else
+            rm -f "$$tmp"
+            echo "backup FAILED at $$ts" >&2
+          fi
+          find /backups/auto -name 'vignette-*.dump' -mtime +${VIGNETTE_BACKUP_RETENTION_DAYS:-14} -delete
+          sleep 86400
+        done
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-vignette_owner}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?NAS PostgreSQL owner password is required}
+      POSTGRES_DB: ${POSTGRES_DB:-vignette}
+    volumes:
+      - type: bind
+        source: ./backups/auto
+        target: /backups/auto
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      <<: *production-labels
+      com.vignette.data-role: database-backup
+    networks: [backend]
+
   engine:
     <<: *api-image
     command: