diff --git a/failover/sync-usb-backup.sh b/failover/sync-usb-backup.sh
new file mode 100755
index 0000000..eb02ac8
--- /dev/null
+++ b/failover/sync-usb-backup.sh
@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Refresh the USB disk (sda) as a live boot-fallback clone of the
+# running root filesystem. Run manually after a push:
+#   sudo ./failover/sync-usb-backup.sh
+#
+# EEPROM BOOT_ORDER falls back to the SD card, then this USB disk, if the
+# primary boot disk (NVMe) doesn't come up. /etc/fstab, /etc/machine-id,
+# and /var/log are excluded from the sync so the clone keeps its own
+# partition identity (PARTUUIDs differ per disk) and boot/journal history
+# instead of inheriting the source disk's — see failover/README or repo
+# memory "sd-fallback-fstab-clobber" for what breaks if those leak across.
+set -euo pipefail
+
+[ "$(id -u)" -eq 0 ] || { echo "Run as root (sudo)." >&2; exit 1; }
+
+USB_ROOT_PART=/dev/sda2
+MOUNT_POINT=/mnt/usb-backup-root
+
+root_src=$(findmnt -no SOURCE /)
+if [ "$root_src" = "$USB_ROOT_PART" ]; then
+    echo "Currently booted from $USB_ROOT_PART — refusing to sync USB onto itself." >&2
+    exit 1
+fi
+
+mkdir -p "$MOUNT_POINT"
+mounted_here=0
+if ! mountpoint -q "$MOUNT_POINT"; then
+    mount "$USB_ROOT_PART" "$MOUNT_POINT"
+    mounted_here=1
+else
+    mount -o remount,rw "$MOUNT_POINT"
+fi
+
+cleanup() {
+    if [ "$mounted_here" -eq 1 ]; then
+        umount "$MOUNT_POINT"
+    fi
+}
+trap cleanup EXIT
+
+rsync -aHAX --numeric-ids --delete \
+    --info=progress2 \
+    --exclude=/proc/* --exclude=/sys/* --exclude=/dev/* --exclude=/run/* \
+    --exclude=/tmp/* --exclude=/mnt/* --exclude=/media/* --exclude=/lost+found \
+    --exclude=/boot/firmware/* --exclude=/swapfile \
+    --exclude=/etc/fstab --exclude=/etc/machine-id --exclude=/var/log/* \
+    --stats / "$MOUNT_POINT/"
+
+echo "USB backup ($USB_ROOT_PART) synced from $root_src."