diff --git a/roles/app/README.md b/roles/app/README.md
index 371dba6..2a905b9 100644
--- a/roles/app/README.md
+++ b/roles/app/README.md
@@ -327,6 +327,7 @@ The `templates/` directory of the calling shim role is discovered automatically
 
 | Variable | Default | Description |
 |----------|---------|-------------|
+| `app_backup` | `true` | Whether backups run when invoked with `--tags backup`; set `false` to opt a host out |
 | `app_backup_subdirectories` | `[]` | Specific directories to backup |
 | `app_backup_stop_services` | `true` | Stop containers during backup |
 | `app_backup_retention_days_controller` | `90` | Controller backup retention |
diff --git a/roles/app/defaults/main.yml b/roles/app/defaults/main.yml
index 08f3092..858e551 100644
--- a/roles/app/defaults/main.yml
+++ b/roles/app/defaults/main.yml
@@ -8,7 +8,7 @@ app_restart_policy: unless-stopped
 
 app_backup_path: "{{ backup_path }}/{{ app_name }}"
 app_backup_path_remote: "{{ app_dir }}/backups"
-app_backup: false
+app_backup: true
 app_backup_subdirectories: []
 app_backup_stop_services: true
 app_backup_retention_days_controller: 90