diff --git a/docs/backup-restore.md b/docs/backup-restore.md
index 0a02117..5a3f5d9 100644
--- a/docs/backup-restore.md
+++ b/docs/backup-restore.md
@@ -61,8 +61,36 @@ Using `/public.php/webdav/` returns HTTP **409** (*Files cannot be created in
 non-existent collections*) on current Nextcloud — that path is not valid for
 public file-drop shares.
 
-Uploads use a direct HTTP PUT via curl (`-u <token>:`). rclone is optional;
-the backup scripts do not require it.
+Uploads use a direct HTTP PUT via curl (`-u <token>:`). The backup scripts do
+not use rclone.
+
+### rclone and file-drop limits
+
+A `~/.config/rclone/rclone.conf` remote is useful as documentation of the
+filesdrop URL, but **public file-drop shares are upload-only**. Nextcloud allows
+only **PUT, MKCOL, and MOVE** on this endpoint — not PROPFIND, GET, or LIST.
+
+| Operation | Typical result |
+| --- | --- |
+| `curl -T` (backup scripts) | Works (HTTP 201) |
+| `rclone lsd` / `rclone ls` | **405** — listing not allowed |
+| `rclone copyto` | Often **405** after upload — rclone probes metadata the share forbids |
+
+If you maintain a rclone remote, point it at the filesdrop base (not
+`/public.php/webdav/`):
+
+```ini
+[nextcloud-backup]
+type = webdav
+url = https://<host>/public.php/dav/filesdrop/<share-token>/
+vendor = nextcloud
+user = <share-token>
+pass =
+```
+
+Do not rely on rclone to verify uploads or restore from offsite copies — use
+Nextcloud admin read access, the local cache under `~/.cache/railiance/backups/`,
+or the restore procedure below.
 
 A local cache of the last 7 backups of each type is kept in
 `~/.cache/railiance/backups/`.