diff --git a/packages/apps/postgres/templates/db.yaml b/packages/apps/postgres/templates/db.yaml
index a59b137d1..b9ad00c30 100644
--- a/packages/apps/postgres/templates/db.yaml
+++ b/packages/apps/postgres/templates/db.yaml
@@ -262,6 +262,15 @@ spec:
   {{- if .Values.backup.retentionPolicy }}
   retentionPolicy: {{ .Values.backup.retentionPolicy | quote }}
   {{- end }}
+  # Ceph RGW and other non-AWS S3-compatible backends reject botocore's default
+  # flexible request checksum (the x-amz-content-sha256 that barman-cloud's
+  # boto3 sends on every upload) with "InvalidArgument: x-amz-content-sha256
+  # must be UNSIGNED-PAYLOAD, ...". Compute a checksum only when the operation
+  # requires one; AWS S3 accepts this too, so it is a safe default everywhere.
+  instanceSidecarConfiguration:
+    env:
+      - name: AWS_REQUEST_CHECKSUM_CALCULATION
+        value: when_required
   configuration:
     destinationPath: {{ $destinationPath }}
     endpointURL: {{ $endpointURL }}
@@ -288,6 +297,11 @@ kind: ObjectStore
 metadata:
   name: {{ .Release.Name }}-recovery
 spec:
+  # Same non-AWS S3 request-checksum workaround as the backup ObjectStore above.
+  instanceSidecarConfiguration:
+    env:
+      - name: AWS_REQUEST_CHECKSUM_CALCULATION
+        value: when_required
   configuration:
     destinationPath: {{ $destinationPath }}
     endpointURL: {{ $endpointURL }}
diff --git a/packages/system/keycloak/templates/db.yaml b/packages/system/keycloak/templates/db.yaml
index 8b8b32823..d33766583 100644
--- a/packages/system/keycloak/templates/db.yaml
+++ b/packages/system/keycloak/templates/db.yaml
@@ -51,6 +51,15 @@ spec:
   {{- if .Values.backup.retentionPolicy }}
   retentionPolicy: {{ .Values.backup.retentionPolicy | quote }}
   {{- end }}
+  # Ceph RGW and other non-AWS S3-compatible backends reject botocore's default
+  # flexible request checksum (the x-amz-content-sha256 that barman-cloud's
+  # boto3 sends on every upload) with "InvalidArgument: x-amz-content-sha256
+  # must be UNSIGNED-PAYLOAD, ...". Compute a checksum only when the operation
+  # requires one; AWS S3 accepts this too, so it is a safe default everywhere.
+  instanceSidecarConfiguration:
+    env:
+      - name: AWS_REQUEST_CHECKSUM_CALCULATION
+        value: when_required
   configuration:
     destinationPath: {{ .Values.backup.destinationPath | quote }}
     {{- with .Values.backup.endpointURL }}