diff --git a/prisma/migrations/20260924140414_add_pre_deployment_backup/migration.sql b/prisma/migrations/20260924140414_add_pre_deployment_backup/migration.sql
new file mode 100644
index 00000000..e383562d
--- /dev/null
+++ b/prisma/migrations/20260924140414_add_pre_deployment_backup/migration.sql
@@ -0,0 +1,22 @@
+-- RedefineTables
+PRAGMA defer_foreign_keys=ON;
+PRAGMA foreign_keys=OFF;
+CREATE TABLE "new_VolumeBackup" (
+    "id" TEXT NOT NULL PRIMARY KEY,
+    "volumeId" TEXT NOT NULL,
+    "targetId" TEXT NOT NULL,
+    "cron" TEXT NOT NULL,
+    "retention" INTEGER NOT NULL,
+    "useDatabaseBackup" BOOLEAN NOT NULL DEFAULT false,
+    "backupBeforeDeployment" BOOLEAN NOT NULL DEFAULT false,
+    "failSilently" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" DATETIME NOT NULL,
+    CONSTRAINT "VolumeBackup_volumeId_fkey" FOREIGN KEY ("volumeId") REFERENCES "AppVolume" ("id") ON DELETE CASCADE ON UPDATE CASCADE,
+    CONSTRAINT "VolumeBackup_targetId_fkey" FOREIGN KEY ("targetId") REFERENCES "S3Target" ("id") ON DELETE CASCADE ON UPDATE CASCADE
+);
+INSERT INTO "new_VolumeBackup" ("createdAt", "cron", "id", "retention", "targetId", "updatedAt", "useDatabaseBackup", "volumeId") SELECT "createdAt", "cron", "id", "retention", "targetId", "updatedAt", "useDatabaseBackup", "volumeId" FROM "VolumeBackup";
+DROP TABLE "VolumeBackup";
+ALTER TABLE "new_VolumeBackup" RENAME TO "VolumeBackup";
+PRAGMA foreign_keys=ON;
+PRAGMA defer_foreign_keys=OFF;
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 809ab7ec..fdbe8df8 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -616,14 +616,16 @@ model S3Target {
 }
 
 model VolumeBackup {
-  id                String    @id @default(uuid())
-  volumeId          String
-  volume            AppVolume @relation(fields: [volumeId], references: [id], onDelete: Cascade)
-  targetId          String
-  target            S3Target  @relation(fields: [targetId], references: [id], onDelete: Cascade)
-  cron              String
-  retention         Int
-  useDatabaseBackup Boolean   @default(false) // decides wether backup whole volume or make a dump of the databse (only for database volumes)
+  id                     String    @id @default(uuid())
+  volumeId               String
+  volume                 AppVolume @relation(fields: [volumeId], references: [id], onDelete: Cascade)
+  targetId               String
+  target                 S3Target  @relation(fields: [targetId], references: [id], onDelete: Cascade)
+  cron                   String
+  retention              Int
+  useDatabaseBackup      Boolean   @default(false) // decides wether backup whole volume or make a dump of the databse (only for database volumes)
+  backupBeforeDeployment Boolean   @default(false) // run this backup automatically before a deployment is applied
+  failSilently           Boolean   @default(false) // continue the deployment even if this backup fails
 
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
diff --git a/src/__tests__/integration/server/services/volume-backup.service.integration.spec.ts b/src/__tests__/integration/server/services/volume-backup.service.integration.spec.ts
new file mode 100644
index 00000000..56f40170
--- /dev/null
+++ b/src/__tests__/integration/server/services/volume-backup.service.integration.spec.ts
@@ -0,0 +1,185 @@
+// @vitest-environment node
+
+import mockNextJsCaching from '@/__tests__/nextjs-cache.utils';
+mockNextJsCaching();
+
+vi.mock('@/server/adapter/kubernetes-api.adapter', () => ({ default: {} }));
+vi.mock('@/server/services/deployment-logs.service', () => ({ default: {}, dlog: vi.fn() }));
+
+import { createPrismaTestContext } from '@/__tests__/prisma-test.utils';
+import dataAccess from '@/server/adapter/db.client';
+import volumeBackupService from '@/server/services/volume-backup.service';
+import backupService from '@/server/services/standalone-services/backup.service';
+import { dlog } from '@/server/services/deployment-logs.service';
+import { AppExtendedModel } from '@/shared/model/app-extended.model';
+
+const dlogMock = dlog as unknown as ReturnType<typeof vi.fn>;
+
+describe('volume-backup.service pre-deployment backups integration', () => {
+    createPrismaTestContext('volume-backup-service-pre-deployment');
+
+    const runBackupForSchedule = vi.fn();
+
+    beforeEach(() => {
+        runBackupForSchedule.mockReset();
+        runBackupForSchedule.mockResolvedValue(undefined);
+        vi.spyOn(backupService, 'runBackupForSchedule').mockImplementation(runBackupForSchedule);
+        dlogMock.mockReset();
+        dlogMock.mockResolvedValue(undefined);
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    async function createApp(projectId: string, id: string) {
+        return dataAccess.client.app.create({
+            data: { id, name: `app-${id}`, projectId },
+        });
+    }
+
+    async function createBackup(appId: string, options: {
+        createdAt: Date;
+        backupBeforeDeployment: boolean;
+        failSilently?: boolean;
+    }) {
+        const target = await dataAccess.client.s3Target.create({
+            data: {
+                name: `target-${appId}-${options.createdAt.getTime()}`,
+                bucketName: 'bucket',
+                endpoint: 'https://s3.example.com',
+                region: 'eu-west-1',
+                accessKeyId: 'key',
+                secretKey: 'secret',
+            },
+        });
+        const volume = await dataAccess.client.appVolume.create({
+            data: { appId, containerMountPath: `/data-${options.createdAt.getTime()}`, size: 1 },
+        });
+        return dataAccess.client.volumeBackup.create({
+            data: {
+                volumeId: volume.id,
+                targetId: target.id,
+                cron: '0 4 * * *',
+                retention: 3,
+                backupBeforeDeployment: options.backupBeforeDeployment,
+                failSilently: options.failSilently ?? false,
+                createdAt: options.createdAt,
+            },
+        });
+    }
+
+    async function addRule(sourceAppId: string, targetAppId: string) {
+        const policy = await dataAccess.client.appNetworkPolicy.upsert({
+            where: { appId: sourceAppId },
+            create: { appId: sourceAppId },
+            update: {},
+        });
+        await dataAccess.client.appNetworkPolicyRule.create({
+            data: {
+                appNetworkPolicyId: policy.id,
+                type: 'EGRESS',
+                targetAppId,
+                port: 5432,
+                protocol: 'TCP',
+            },
+        });
+    }
+
+    it('runs opted-in backups of the app and its directly connected apps in the same project', async () => {
+        const project = await dataAccess.client.project.create({ data: { name: 'P', projectType: 'APP' } });
+        const app = await createApp(project.id, 'app-target');
+        const connectedViaIncoming = await createApp(project.id, 'app-incoming');
+        const connectedViaOutgoing = await createApp(project.id, 'app-outgoing');
+        const unrelated = await createApp(project.id, 'app-unrelated');
+
+        const base = Date.now();
+        const ownBackup = await createBackup(app.id, { createdAt: new Date(base), backupBeforeDeployment: true });
+        const incomingBackup = await createBackup(connectedViaIncoming.id, { createdAt: new Date(base + 1), backupBeforeDeployment: true });
+        const outgoingBackup = await createBackup(connectedViaOutgoing.id, { createdAt: new Date(base + 2), backupBeforeDeployment: true });
+        await createBackup(unrelated.id, { createdAt: new Date(base + 3), backupBeforeDeployment: true });
+        await createBackup(app.id, { createdAt: new Date(base + 4), backupBeforeDeployment: false });
+
+        // incoming: the peer points at the deployed app
+        await addRule(connectedViaIncoming.id, app.id);
+        // outgoing: the deployed app points at the peer
+        await addRule(app.id, connectedViaOutgoing.id);
+
+        await volumeBackupService.runBackupsBeforeDeployment('dep-1', {
+            id: app.id,
+            projectId: project.id,
+        } as AppExtendedModel);
+
+        expect(runBackupForSchedule.mock.calls.map(call => call[0]))
+            .toEqual([ownBackup.id, incomingBackup.id, outgoingBackup.id]);
+    });
+
+    it('ignores connected apps from other projects', async () => {
+        const project = await dataAccess.client.project.create({ data: { name: 'P', projectType: 'APP' } });
+        const otherProject = await dataAccess.client.project.create({ data: { name: 'Other', projectType: 'APP' } });
+        const app = await createApp(project.id, 'app-target');
+        const foreignApp = await createApp(otherProject.id, 'app-foreign');
+
+        await createBackup(foreignApp.id, { createdAt: new Date(), backupBeforeDeployment: true });
+        await addRule(foreignApp.id, app.id);
+
+        await volumeBackupService.runBackupsBeforeDeployment('dep-1', {
+            id: app.id,
+            projectId: project.id,
+        } as AppExtendedModel);
+
+        expect(runBackupForSchedule).not.toHaveBeenCalled();
+    });
+
+    it('aborts the deployment when a non-silent backup fails, after running the remaining backups', async () => {
+        const project = await dataAccess.client.project.create({ data: { name: 'P', projectType: 'APP' } });
+        const app = await createApp(project.id, 'app-target');
+
+        const base = Date.now();
+        const failing = await createBackup(app.id, { createdAt: new Date(base), backupBeforeDeployment: true, failSilently: false });
+        const remaining = await createBackup(app.id, { createdAt: new Date(base + 1), backupBeforeDeployment: true, failSilently: true });
+
+        runBackupForSchedule.mockImplementation(async (id: string) => {
+            if (id === failing.id) {
+                throw new Error('pod not running');
+            }
+        });
+
+        await expect(volumeBackupService.runBackupsBeforeDeployment('dep-1', {
+            id: app.id,
+            projectId: project.id,
+        } as AppExtendedModel)).rejects.toThrow('Deployment aborted');
+
+        expect(runBackupForSchedule.mock.calls.map(call => call[0]))
+            .toEqual([failing.id, remaining.id]);
+    });
+
+    it('continues the deployment when a silent backup fails', async () => {
+        const project = await dataAccess.client.project.create({ data: { name: 'P', projectType: 'APP' } });
+        const app = await createApp(project.id, 'app-target');
+
+        const failing = await createBackup(app.id, { createdAt: new Date(), backupBeforeDeployment: true, failSilently: true });
+        runBackupForSchedule.mockRejectedValue(new Error('boom'));
+
+        await expect(volumeBackupService.runBackupsBeforeDeployment('dep-1', {
+            id: app.id,
+            projectId: project.id,
+        } as AppExtendedModel)).resolves.toBeUndefined();
+
+        expect(runBackupForSchedule).toHaveBeenCalledWith(failing.id);
+    });
+
+    it('does nothing when no schedule opted in', async () => {
+        const project = await dataAccess.client.project.create({ data: { name: 'P', projectType: 'APP' } });
+        const app = await createApp(project.id, 'app-target');
+        await createBackup(app.id, { createdAt: new Date(), backupBeforeDeployment: false });
+
+        await volumeBackupService.runBackupsBeforeDeployment('dep-1', {
+            id: app.id,
+            projectId: project.id,
+        } as AppExtendedModel);
+
+        expect(runBackupForSchedule).not.toHaveBeenCalled();
+        expect(dlogMock).not.toHaveBeenCalled();
+    });
+});
diff --git a/src/app/project/app/[appId]/volumes/actions.ts b/src/app/project/app/[appId]/volumes/actions.ts
index c06a65fb..dde12d51 100644
--- a/src/app/project/app/[appId]/volumes/actions.ts
+++ b/src/app/project/app/[appId]/volumes/actions.ts
@@ -11,7 +11,6 @@ import { fileMountEditZodModel } from "@/shared/model/file-mount-edit.model";
 import { VolumeBackupEditModel, volumeBackupEditZodModel } from "@/shared/model/backup-volume-edit.model";
 import volumeBackupService from "@/server/services/volume-backup.service";
 import backupService from "@/server/services/standalone-services/backup.service";
-import databaseBackupService from "@/server/services/standalone-services/database-backup.service";
 import { volumeUploadZodModel } from "@/shared/model/volume-upload.model";
 import restoreService from "@/server/services/restore.service";
 import fileBrowserService from "@/server/services/file-browser-service";
@@ -168,16 +167,7 @@ export const deleteBackupVolume = async (backupVolumeId: string) =>
 export const runBackupVolumeSchedule = async (backupVolumeId: string) =>
     simpleAction(async () => {
         await validateBackupVolumeWriteAuthorization(backupVolumeId);
-
-        const backupVolume = await volumeBackupService.getWithVolumeAndAppById(backupVolumeId);
-
-        // Use database-specific backup if it's a database app AND useDatabaseBackup is true
-        if (backupVolume.volume.app.appType !== 'APP' && backupVolume.useDatabaseBackup) {
-            await databaseBackupService.backupDatabase(backupVolumeId);
-        } else {
-            await backupService.runBackupForVolume(backupVolumeId);
-        }
-
+        await backupService.runBackupForSchedule(backupVolumeId);
         return new SuccessActionResult(undefined, 'Backup created and uploaded successfully');
     });
 
diff --git a/src/app/project/app/[appId]/volumes/volume-backup-edit-overlay.tsx b/src/app/project/app/[appId]/volumes/volume-backup-edit-overlay.tsx
index 741e2462..2f18a4bb 100644
--- a/src/app/project/app/[appId]/volumes/volume-backup-edit-overlay.tsx
+++ b/src/app/project/app/[appId]/volumes/volume-backup-edit-overlay.tsx
@@ -1,7 +1,7 @@
 'use client'
 
 import type { z } from "zod";
-import { DialogDescription, DialogHeader, DialogTitle } from "@/components/ui/dialog"
+import { DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "@/components/ui/dialog"
 import {
   Form,
   FormControl,
@@ -26,8 +26,11 @@ import { VolumeBackupEditModel, volumeBackupEditZodModel } from "@/shared/model/
 import SelectFormField from "@/components/custom/select-form-field"
 import Link from "next/link"
 import { Checkbox } from "@/components/ui/checkbox"
+import { Switch } from "@/components/ui/switch"
+import FormLabelWithQuestion from "@/components/custom/form-label-with-question"
 import { AppExtendedModel } from "@/shared/model/app-extended.model"
 import { useDialog } from "@/frontend/states/zustand.states";
+import { ScrollArea } from "@/components/ui/scroll-area";
 
 export default function VolumeBackupEditDialog({
   volumeBackup,
@@ -59,9 +62,13 @@ export default function VolumeBackupEditDialog({
       targetId: volumeBackup?.targetId || (s3Targets.length === 1 ? s3Targets[0].id : undefined),
       volumeId: volumeBackup?.volumeId || (volumes.length === 1 ? volumes[0].id : undefined),
       useDatabaseBackup: volumeBackup?.useDatabaseBackup ?? (isDatabaseApp && isDatabaseBackupSupported),
+      backupBeforeDeployment: volumeBackup?.backupBeforeDeployment ?? false,
+      failSilently: volumeBackup?.failSilently ?? false,
     }
   });
 
+  const backupBeforeDeployment = form.watch('backupBeforeDeployment');
+
   const [state, formAction] = useActionState((state: ServerActionResult<any, any>,
     payload: VolumeBackupEditModel) =>
     saveBackupVolume(state, {
@@ -84,18 +91,22 @@ export default function VolumeBackupEditDialog({
   }, [volumeBackup, volumes, s3Targets, form]);
 
   return (
-    <>
-          <DialogHeader>
-            <DialogTitle>Edit Backup Configuration</DialogTitle>
-            <DialogDescription>
-              Configure the backup settings for this volume.
-            </DialogDescription>
-          </DialogHeader>
-          <Form {...form}>
-            <form action={() => form.handleSubmit((data) => {
-              return formAction(data);
-            }, console.error)()}>
-              <div className="space-y-4">
+    <Form {...form}>
+      <form
+        className="flex max-h-[calc(100dvh-3rem)] flex-col overflow-hidden"
+        action={() => form.handleSubmit(
+          (data) => formAction(data),
+          console.error,
+        )()}
+      >
+        <DialogHeader>
+          <DialogTitle>Edit Backup Configuration</DialogTitle>
+          <DialogDescription>
+            Configure the backup settings for this volume.
+          </DialogDescription>
+        </DialogHeader>
+        <ScrollArea className="mt-4 min-h-0 flex-1">
+          <div className="space-y-4 px-2">
                 <FormField
                   control={form.control}
                   name="cron"
@@ -177,12 +188,52 @@ export default function VolumeBackupEditDialog({
                   />
                 )}
 
-                <p className="text-red-500">{state.message}</p>
-                <SubmitButton>Save</SubmitButton>
-              </div>
-            </form>
-          </Form >
-    </>
+                <FormField
+                  control={form.control}
+                  name="backupBeforeDeployment"
+                  render={({ field }) => (
+                    <FormItem className="flex flex-row items-center justify-between rounded-lg border p-3">
+                      <FormLabelWithQuestion hint="Run this backup automatically before a deployment is applied. This also applies when an app connected through a network policy is deployed.">
+                        Backup before deployment
+                      </FormLabelWithQuestion>
+                      <FormControl>
+                        <Switch
+                          checked={field.value}
+                          onCheckedChange={field.onChange}
+                        />
+                      </FormControl>
+                    </FormItem>
+                  )}
+                />
+
+                {backupBeforeDeployment && (
+                  <FormField
+                    control={form.control}
+                    name="failSilently"
+                    render={({ field }) => (
+                      <FormItem className="flex flex-row items-center justify-between rounded-lg border p-3">
+                        <FormLabelWithQuestion hint="Continue with the deployment even if this backup fails. When disabled, a failed backup aborts the deployment.">
+                          Fail silently on deployment
+                        </FormLabelWithQuestion>
+                        <FormControl>
+                          <Switch
+                            checked={field.value}
+                            onCheckedChange={field.onChange}
+                          />
+                        </FormControl>
+                      </FormItem>
+                    )}
+                  />
+                )}
+
+            <p className="text-red-500">{state.message}</p>
+          </div>
+        </ScrollArea>
+        <DialogFooter className="mt-4">
+          <SubmitButton>Save</SubmitButton>
+        </DialogFooter>
+      </form>
+    </Form>
   )
 
 
diff --git a/src/app/project/app/[appId]/volumes/volume-backup.tsx b/src/app/project/app/[appId]/volumes/volume-backup.tsx
index 8d6d6287..97d8b5fb 100644
--- a/src/app/project/app/[appId]/volumes/volume-backup.tsx
+++ b/src/app/project/app/[appId]/volumes/volume-backup.tsx
@@ -81,6 +81,7 @@ export default function VolumeBackupList({
                             <TableHead>Retention</TableHead>
                             <TableHead className="hidden 2xl:table-cell">Backup Method</TableHead>
                             <TableHead className="hidden xl:table-cell">Backup Location</TableHead>
+                            <TableHead className="hidden lg:table-cell">Run Before Deployment</TableHead>
                             {(onBackupScheduleClick || !readonly) && <TableHead className="w-[120px]"></TableHead>}
                         </TableRow>
                     </TableHeader>
@@ -95,6 +96,11 @@ export default function VolumeBackupList({
                                         : 'Archive of Volume'}
                                 </TableCell>
                                 <TableCell className="hidden font-medium xl:table-cell">{volumeBackup.target.name}</TableCell>
+                                <TableCell className="hidden font-medium lg:table-cell">
+                                    {volumeBackup.backupBeforeDeployment
+                                        ? (volumeBackup.failSilently ? 'Yes (silent)' : 'Yes')
+                                        : 'No'}
+                                </TableCell>
                                 {(onBackupScheduleClick || !readonly) && <TableCell className="w-[120px] font-medium">
                                     <div className="flex gap-1 opacity-100 transition-opacity duration-150 sm:opacity-0 sm:group-hover:opacity-100 sm:group-focus-within:opacity-100">
                                     {onBackupScheduleClick && <Button
diff --git a/src/components/custom/form-label-with-question.tsx b/src/components/custom/form-label-with-question.tsx
index d3804d74..08dec4e2 100644
--- a/src/components/custom/form-label-with-question.tsx
+++ b/src/components/custom/form-label-with-question.tsx
@@ -6,7 +6,7 @@ import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "../ui/
 export default function FormLabelWithQuestion(
     { children, hint }: { children: React.ReactNode, hint: string | React.ReactNode }
 ) {
-    return <div className="flex gap-1 mt-1 pb-1">
+    return <div className="flex gap-1.5 mt-1 pb-1">
         <FormLabel>{children}</FormLabel>
         <div>
             <TooltipProvider>
diff --git a/src/server/services/deployment.service.ts b/src/server/services/deployment.service.ts
index fd3b242b..ac7eb0a9 100644
--- a/src/server/services/deployment.service.ts
+++ b/src/server/services/deployment.service.ts
@@ -25,6 +25,7 @@ import { AppBuildMethod } from "@/shared/model/app-source-info.model";
 import { GitHashUtils } from "@/shared/utils/git-hash.utils";
 import { DeploymentSource } from "@/shared/model/deployment-source.model";
 import { RollbackAnnotationUtils } from "@/shared/utils/rollback-annotation.utils";
+import volumeBackupService from "./volume-backup.service";
 
 class DeploymentService {
 
@@ -89,6 +90,8 @@ class DeploymentService {
         const { buildJobName, gitCommitHash, gitCommitMessage, buildMethod, isRollback } = source ?? {};
         await this.validateDeployment(app);
 
+        await volumeBackupService.runBackupsBeforeDeployment(deploymentId, app);
+
         dlog(deploymentId, `Shutting down FileBrowsers (if active)`);
         for (let volume of app.appVolumes) {
             await fileBrowserService.deleteFileBrowserForVolumeIfExists(volume.id);
diff --git a/src/server/services/deployment.service.unit.spec.ts b/src/server/services/deployment.service.unit.spec.ts
index ec02fb6f..1fec6583 100644
--- a/src/server/services/deployment.service.unit.spec.ts
+++ b/src/server/services/deployment.service.unit.spec.ts
@@ -11,6 +11,9 @@ vi.mock('@/server/services/file-browser-service', () => ({ default: {} }));
 vi.mock('@/server/services/pod.service', () => ({ default: {} }));
 vi.mock('@/server/services/network-policy.service', () => ({ default: {} }));
 vi.mock('@/server/services/deployment-logs.service', () => ({ dlog: vi.fn() }));
+vi.mock('@/server/services/volume-backup.service', () => ({
+    default: { runBackupsBeforeDeployment: vi.fn() },
+}));
 
 import deploymentService from './deployment.service';
 
diff --git a/src/server/services/network-policy.service.ts b/src/server/services/network-policy.service.ts
index bdf5a4b5..060bfa1a 100644
--- a/src/server/services/network-policy.service.ts
+++ b/src/server/services/network-policy.service.ts
@@ -1,5 +1,6 @@
 import { AppExtendedModel, AppNetworkPolicyRuleWithTargetModel } from "@/shared/model/app-extended.model";
 import k3s from "../adapter/kubernetes-api.adapter";
+import dataAccess from "../adapter/db.client";
 import { V1NetworkPolicy, V1NetworkPolicyEgressRule, V1NetworkPolicyIngressRule, V1NetworkPolicyPeer } from "@kubernetes/client-node";
 import { KubeObjectNameUtils } from "../utils/kube-object-name.utils";
 import { Constants } from "../../shared/utils/constants";
@@ -65,6 +66,50 @@ class NetworkPolicyService {
         await this.applyNetworkPolicy(namespace, policyName, policy);
     }
 
+    /**
+     * IDs of the apps in the same project that are directly connected to the
+     * given app through the app network policy (1 hop, both directions).
+     * Mirrored rules can live on either side of a connection, so rules are
+     * collected in both directions.
+     */
+    async getDirectlyConnectedAppIds(app: Pick<AppExtendedModel, 'id' | 'projectId'>): Promise<string[]> {
+        const rules = await dataAccess.client.appNetworkPolicyRule.findMany({
+            where: {
+                targetAppId: { not: null },
+                OR: [
+                    { targetAppId: app.id },
+                    { appNetworkPolicy: { is: { appId: app.id } } },
+                ],
+            },
+            select: {
+                targetAppId: true,
+                appNetworkPolicy: { select: { appId: true } },
+            },
+        });
+
+        const peerAppIds = new Set<string>();
+        for (const rule of rules) {
+            const peerAppId = rule.appNetworkPolicy.appId === app.id
+                ? rule.targetAppId
+                : rule.appNetworkPolicy.appId;
+            if (peerAppId && peerAppId !== app.id) {
+                peerAppIds.add(peerAppId);
+            }
+        }
+        if (peerAppIds.size === 0) {
+            return [];
+        }
+
+        const peersInProject = await dataAccess.client.app.findMany({
+            where: {
+                id: { in: [...peerAppIds] },
+                projectId: app.projectId,
+            },
+            select: { id: true },
+        });
+        return peersInProject.map(peer => peer.id);
+    }
+
     private getExtendedIngressRules(appId: string, rules: AppNetworkPolicyRuleWithTargetModel[], hasDomains: boolean, nodePorts: { port: number; protocol?: string }[]): V1NetworkPolicyIngressRule[] {
         const result: V1NetworkPolicyIngressRule[] = [];
         // Traffic between replicas of the same App is always allowed on all ports.
diff --git a/src/server/services/standalone-services/backup.service.ts b/src/server/services/standalone-services/backup.service.ts
index 6bc3c459..8411168e 100644
--- a/src/server/services/standalone-services/backup.service.ts
+++ b/src/server/services/standalone-services/backup.service.ts
@@ -41,12 +41,7 @@ class BackupService {
                 console.log(`Running backup for ${volumeBackups.length} volumes...`);
                 for (const volumeBackup of volumeBackups) {
                     try {
-                        // Use database-specific backup if it's a database app AND useDatabaseBackup is true
-                        if (volumeBackup.volume.app.appType !== 'APP' && volumeBackup.useDatabaseBackup) {
-                            await databaseBackupService.backupDatabase(volumeBackup.id);
-                        } else {
-                            await this.runBackupForVolume(volumeBackup.id);
-                        }
+                        await this.runBackupForSchedule(volumeBackup.id);
                     } catch (e) {
                         console.error(`Error during backup for volume ${volumeBackup.volumeId} and backup ${volumeBackup.id}`);
                         console.error(e);
@@ -260,6 +255,31 @@ class BackupService {
         return backupData;
     }
 
+    /**
+     * Runs the backup schedule with the configured method. Database apps with
+     * useDatabaseBackup use their native dump tool, everything else copies the
+     * whole volume as an archive.
+     */
+    async runBackupForSchedule(backupVolumeId: string) {
+        const backupVolume = await dataAccess.client.volumeBackup.findFirstOrThrow({
+            where: {
+                id: backupVolumeId
+            },
+            include: {
+                volume: {
+                    include: {
+                        app: true
+                    }
+                }
+            }
+        });
+
+        if (backupVolume.volume.app.appType !== 'APP' && backupVolume.useDatabaseBackup) {
+            return databaseBackupService.backupDatabase(backupVolumeId);
+        }
+        return this.runBackupForVolume(backupVolumeId);
+    }
+
     async runBackupForVolume(backupVolumeId: string) {
         console.log(`Running backup for backupVolume ${backupVolumeId}`);
 
diff --git a/src/server/services/volume-backup.service.ts b/src/server/services/volume-backup.service.ts
index d714b202..d1ff0528 100644
--- a/src/server/services/volume-backup.service.ts
+++ b/src/server/services/volume-backup.service.ts
@@ -3,6 +3,11 @@ import dataAccess from "../adapter/db.client";
 import { Tags } from "../utils/cache-tag-generator.utils";
 import { Prisma, VolumeBackup } from "@prisma/client";
 import { VolumeBackupExtendedModel } from "@/shared/model/volume-backup-extended.model";
+import { AppExtendedModel } from "@/shared/model/app-extended.model";
+import { ServiceException } from "@/shared/model/service.exception.model";
+import { dlog } from "./deployment-logs.service";
+import networkPolicyService from "./network-policy.service";
+import backupService from "./standalone-services/backup.service";
 
 class VolumeBackupService {
 
@@ -47,17 +52,6 @@ class VolumeBackupService {
         });
     }
 
-    async getWithVolumeAndAppById(id: string) {
-        return dataAccess.client.volumeBackup.findFirstOrThrow({
-            where: { id },
-            include: {
-                volume: {
-                    include: { app: true },
-                },
-            },
-        });
-    }
-
     async getAppIdById(id: string) {
         const volumeBackup = await dataAccess.client.volumeBackup.findFirstOrThrow({
             where: { id },
@@ -106,6 +100,67 @@ class VolumeBackupService {
             revalidateTag(Tags.volumeBackups());
         }
     }
+
+    /**
+     * Runs the backups that opted in for automatic pre-deployment execution.
+     *
+     * A backup schedule opts in with `backupBeforeDeployment`. Participating
+     * schedules are the ones of the deployed app itself and of every app that
+     * is directly connected to it through the app network policy (1 hop, both
+     * directions, same project). Backups run one after another. A backup that
+     * fails aborts the deployment unless it is marked `failSilently`.
+     */
+    async runBackupsBeforeDeployment(deploymentId: string, app: AppExtendedModel) {
+        const backupsToRun = await this.getBackupsToRunBeforeDeployment(app);
+        if (backupsToRun.length === 0) {
+            return;
+        }
+
+        await dlog(deploymentId, `Running ${backupsToRun.length} automatic backup(s) before deployment...`);
+
+        let abortDeployment = false;
+        let successfullBackupsCount = 0;
+        for (const backup of backupsToRun) {
+            const label = `app "${backup.volume.app.name}" volume "${backup.volume.containerMountPath}"`;
+            try {
+                await dlog(deploymentId, `Starting automatic backup before deployment for ${label}...`);
+                await backupService.runBackupForSchedule(backup.id);
+                await dlog(deploymentId, `✓ Automatic backup finished for ${label}.`);
+                successfullBackupsCount++;
+            } catch (e) {
+                const message = e instanceof Error ? e.message : String(e);
+                await dlog(deploymentId, `[Error] Automatic backup failed for ${label}: ${message}`);
+                if (!backup.failSilently) {
+                    abortDeployment = true;
+                }
+            }
+        }
+
+        if (abortDeployment) {
+            throw new ServiceException('Deployment aborted because an automatic pre-deployment backup failed. Enable "fail silently" on the backup schedule to continue anyway.');
+        }
+        await dlog(deploymentId, `Successfully created ${successfullBackupsCount} backups before deployment`);
+    }
+
+    private async getBackupsToRunBeforeDeployment(app: AppExtendedModel) {
+        const connectedAppIds = await networkPolicyService.getDirectlyConnectedAppIds(app);
+        const appIds = [app.id, ...connectedAppIds];
+
+        return dataAccess.client.volumeBackup.findMany({
+            where: {
+                backupBeforeDeployment: true,
+                volume: {
+                    appId: { in: appIds },
+                },
+            },
+            include: {
+                volume: {
+                    include: { app: true },
+                },
+            },
+            orderBy: { createdAt: 'asc' },
+        });
+    }
 }
 
 const volumeBackupService = new VolumeBackupService();
diff --git a/src/shared/model/backup-volume-edit.model.ts b/src/shared/model/backup-volume-edit.model.ts
index 0a216f3e..d46f963a 100644
--- a/src/shared/model/backup-volume-edit.model.ts
+++ b/src/shared/model/backup-volume-edit.model.ts
@@ -9,6 +9,8 @@ export const volumeBackupEditZodModel = z.object({
   //cron: z.string().trim().min(1),
   retention: stringToNumber,
   useDatabaseBackup: z.boolean().optional(),
+  backupBeforeDeployment: z.boolean().optional(),
+  failSilently: z.boolean().optional(),
 });
 
 export type VolumeBackupEditModel = z.infer<typeof volumeBackupEditZodModel>;
\ No newline at end of file
diff --git a/src/shared/model/generated-zod/volumebackup.ts b/src/shared/model/generated-zod/volumebackup.ts
index be28d564..09abf4e2 100644
--- a/src/shared/model/generated-zod/volumebackup.ts
+++ b/src/shared/model/generated-zod/volumebackup.ts
@@ -9,6 +9,8 @@ export const VolumeBackupModel = z.object({
   cron: z.string(),
   retention: z.number().int(),
   useDatabaseBackup: z.boolean(),
+  backupBeforeDeployment: z.boolean(),
+  failSilently: z.boolean(),
   createdAt: z.date(),
   updatedAt: z.date(),
 })