diff --git a/ks4/restic-backup.md b/ks4/restic-backup.md
index 78aed25..f43a49f 100644
--- a/ks4/restic-backup.md
+++ b/ks4/restic-backup.md
@@ -57,9 +57,10 @@ property).
 
 ### Memory (the real constraint on this 23/31 GiB-used box)
 
-- Index RAM ≈ 200–300 B/blob → ~0.3 GiB (nextcloud) and
-  ~0.6–1.2 GiB (seafile) per backup run; prune peaks 2–3×. Hence the
-  repo split (§1).
+- Index RAM ≈ 200–300 B/blob → combined `restic-data` index
+  ~1–1.5 GiB per operation (nextcloud ~1 M blobs + seafile ~2–4 M);
+  prune peaks 2–3×. Accepted with the merged layout (§1) — measure
+  peak RSS during the evaluation week (`/usr/bin/time -v`).
 - `GOGC=20` trades CPU for a smaller Go heap — enable if the seafile
   prune ever pressures the box.
 
@@ -106,8 +107,23 @@ repo (rustic ignores restic's locks); a clean switchover is fine.
 
 ## 3. Install + init (root on ks4)
 
+Debian 13 ships restic **0.18.0**, which misses fixes we specifically
+need (checked 2026-08-25 against upstream changelogs): the 0.18.1
+crash fix for directories deleted mid-walk (#5421 — our live trees do
+that nightly), 0.19.0's much faster index loading (#5713 — the merged
+restic-data repo loads its index every op) and lower check memory
+(#5610), index-repair robustness (#21827/28), clean exit codes
+(#4467/#5363 — our drivers key off rc), and 0.19.1's
+skip-inaccessible-source fix (#5667 — an unmounted source must not
+commit an empty "successful" snapshot). → install upstream **0.19.1**;
+future upgrades via `restic self-update` (signature-verified).
+
 ```sh
-apt install restic sshfs      # sshfs: needed by `incus file mount` (§6)
+apt install sshfs bzip2       # sshfs: needed by `incus file mount` (§6)
+curl -LO https://github.com/restic/restic/releases/download/v0.19.1/restic_0.19.1_linux_amd64.bz2
+bunzip2 restic_0.19.1_linux_amd64.bz2
+install -m755 restic_0.19.1_linux_amd64 /usr/local/bin/restic
+restic version
 head -c 32 /dev/urandom | base64 > /root/.restic-passphrase && chmod 600 /root/.restic-passphrase
 # ⚠️ password manager, NOW.