diff --git a/docs/SIGNING-KEY-BACKUP.md b/docs/SIGNING-KEY-BACKUP.md
index 709019f..29e050a 100644
--- a/docs/SIGNING-KEY-BACKUP.md
+++ b/docs/SIGNING-KEY-BACKUP.md
@@ -91,3 +91,11 @@ To check backup 1, run this with the stick mounted:
 ```bash
 gpg --decrypt --output /dev/shm/orbit-check.p12 /run/media/pauljd/6FCC-BCBD/Orbit-TV-signing-key/orbit-signing-key.p12.gpg && cmp /dev/shm/orbit-check.p12 /home/pauljd/Documents/OrbitTV/orbit-tv/.tooling/android/debug.keystore && echo MATCH; shred -u /dev/shm/orbit-check.p12
 ```
+
+**8 November 2026, backup 2 made and verified:**
+- A Bitwarden secure note (hosted, EU).
+- AES-256 gpg-encrypted with a separate recovery passphrase, which is kept on paper.
+- It holds the signing key and, wrapped the same way, the Fourth Built gpg key.
+- Paul decrypted both and got MATCH. No plaintext or staging copies were left behind.
+
+**Recovery paths:** the stick with the Fourth Built passphrase, or Bitwarden with the recovery passphrase. Either one is enough on its own.