diff --git a/CHANGELOG.md b/CHANGELOG.md
index ee9c5fd600..53c2ebdf5e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,12 @@
 # CHANGELOG
 ## Release 124.1.5 (in development)
 
+### Enhancements
+
+- Add cleanup functionality to the backup replication job to
+  only keep the latest 5 backup archives
+  (PR[#4038](https://github.com/scality/metalk8s/pull/4038))
+
 ### Bug fixes
 
 - Make metalk8s-sosreport packages compatible with sos version 4.5
@@ -11,6 +17,9 @@
   regenerated
   (PR[#4035](https://github.com/scality/metalk8s/pull/4035))
 
+- Fix a bug that skips backup archive replication
+  (PR[#4038](https://github.com/scality/metalk8s/pull/4038))
+
 ## Release 124.1.4
 
 ### Bug fixes
diff --git a/salt/metalk8s/orchestrate/backup/files/job.yaml.j2 b/salt/metalk8s/orchestrate/backup/files/job.yaml.j2
index bdb941e6ff..1dabcfb2b0 100644
--- a/salt/metalk8s/orchestrate/backup/files/job.yaml.j2
+++ b/salt/metalk8s/orchestrate/backup/files/job.yaml.j2
@@ -22,15 +22,15 @@ spec:
       containers:
       - name: backup-replication
         image: {{ image }}
-        command:
-          - wget
-          - --accept="*.tar.gz"
-          - --no-host-directories
-          - --mirror
-          - --ca-certificate=/certificate/ca.crt
-          - --user=$(BACKUP_USERNAME)
-          - --password=$(BACKUP_PASSWORD)
-          - https://backup/
+        command: ["/bin/sh", "-c"]
+        args:
+          - >-
+            wget --accept="*.tar.gz"
+            --no-host-directories --mirror
+            --ca-certificate=/certificate/ca.crt
+            --user=$(BACKUP_USERNAME)
+            --password=$(BACKUP_PASSWORD)
+            https://backup/ && ls -t -1 /backups/*.tar.gz | tail -n+6 | xargs -t rm -f
         env:
           - name: BACKUP_USERNAME
             valueFrom:
diff --git a/tests/conftest.py b/tests/conftest.py
index 4aa81e3e76..5f2add8009 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -361,6 +361,17 @@ def wait_rollout_status(host, resource, namespace):
     )
 
 
+@when(parsers.parse("we wait {seconds} seconds for the {job} job to complete"))
+def wait_for_job(host, seconds, job):
+    with host.sudo():
+        res = host.run(
+            "kubectl --kubeconfig=/etc/kubernetes/admin.conf "
+            f"wait --for=condition=complete --timeout={seconds}s "
+            f"job -l app.kubernetes.io/name={job} -A"
+        )
+        assert res.rc == 0, res.stdout
+
+
 # }}}
 # Then {{{
 
diff --git a/tests/post/features/backup.feature b/tests/post/features/backup.feature
new file mode 100644
index 0000000000..12f0d0cb93
--- /dev/null
+++ b/tests/post/features/backup.feature
@@ -0,0 +1,6 @@
+@post @ci @local @backup
+Feature: Backup
+    Scenario: Backup multiple times
+        When we run the backup script 6 times
+        And we wait 60 seconds for the backup-replication job to complete
+        Then we have 5 backups on each node
diff --git a/tests/post/steps/test_backup.py b/tests/post/steps/test_backup.py
new file mode 100644
index 0000000000..aa908d0f6a
--- /dev/null
+++ b/tests/post/steps/test_backup.py
@@ -0,0 +1,53 @@
+import json
+
+from pytest_bdd import scenario, when, then, parsers
+
+from tests import utils
+
+# Scenarios
+@scenario("../features/backup.feature", "Backup multiple times")
+def test_backup(host):
+    pass
+
+
+# When
+@when(parsers.parse("we run the backup script {times} times"))
+def run_backup(request, host, times):
+    iso_root = request.config.getoption("--iso-root")
+
+    for _ in range(int(times)):
+        with host.sudo():
+            res = host.run("%s/backup.sh", str(iso_root))
+            assert res.rc == 0, res.stdout
+
+
+# Then
+@then(parsers.parse("we have {count} backups on each node"), converters=dict(count=int))
+def check_backup_archive_count(host, ssh_config, k8s_client, count):
+    master_nodes = [
+        node.metadata.name
+        for node in k8s_client.resources.get(api_version="v1", kind="Node")
+        .get(label_selector=f"node-role.kubernetes.io/master")
+        .items
+    ]
+    assert len(master_nodes) > 0, "No master node found"
+
+    command = [
+        "salt",
+        "--static",
+        "--out json",
+        "-L",
+        f"{','.join(master_nodes)}",
+        "file.find",
+        "/var/lib/metalk8s/backups",
+        "type=f",
+        "name=*.tar.gz",
+        "maxdepth=1",
+    ]
+    ret = json.loads(utils.run_salt_command(host, command, ssh_config).stdout)
+
+    for name, backups in ret.items():
+        assert len(backups) == count, (
+            f"Expected {count} backup archives on "
+            f"node {name}, got {len(backups)}: {backups}"
+        )