diff --git a/README.md b/README.md
index 35a9e97..fb7540d 100644
--- a/README.md
+++ b/README.md
@@ -123,8 +123,13 @@ manifest. A product-side change must not be able to lower its own guard.
 ## Scripts
 
 Operational helpers, all argument-driven (`scripts/`): register a GitHub App with
-Coolify, dump the Coolify control-plane database age-encrypted to S3, restore a
-database backup into a target container.
+Coolify, restore a database backup into a target container.
+
+**They run where cast runs — off the box.** They drive the Coolify API, or reach a
+box over SSH; none of them expects to be executing *on* a server. Anything that
+belongs on a box, as root, under a scheduler is [rig](https://github.com/heavy-duty/rig)'s
+job, not cast's — including the nightly age-encrypted dump of the control-plane
+database, which is now `rig coolify backup install`.
 
 ## Development
 
diff --git a/scripts/dump-coolify-db.sh b/scripts/dump-coolify-db.sh
deleted file mode 100755
index 95512ca..0000000
--- a/scripts/dump-coolify-db.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env bash
-# Nightly on the coolify box: dump Coolify's own Postgres, age-encrypt
-# client-side (dump holds GitHub App key, server SSH keys, all env values),
-# ship to S3. Forensics only — a fresh instance is recreated, never restored.
-set -euo pipefail
-: "${AGE_RECIPIENT:?age public key for the backup identity}"
-: "${S3_BUCKET:?s3 bucket, e.g. s3://my-backups/coolify-db}"
-STAMP=$(date -u +%Y%m%dT%H%M%SZ)
-OUT="/tmp/coolify-db-${STAMP}.sql.age"
-docker exec coolify-db pg_dump -U coolify coolify | age -r "$AGE_RECIPIENT" -o "$OUT"
-aws s3 cp "$OUT" "${S3_BUCKET}/" --endpoint-url "${S3_ENDPOINT:?hetzner s3 endpoint}"
-rm -f "$OUT"