diff --git a/ansible/files/pgbackrest_config/pgbackrest.conf b/ansible/files/pgbackrest_config/pgbackrest.conf
index f54336c4e8..d0849e694d 100644
--- a/ansible/files/pgbackrest_config/pgbackrest.conf
+++ b/ansible/files/pgbackrest_config/pgbackrest.conf
@@ -13,6 +13,8 @@ log-level-console = info
 log-level-file = detail
 log-subprocess = y
 resume = n
+# /data shares a filesystem with pg_wal, letting archive-get hand off WAL segments via rename instead of copy; the old /var/spool/pgbackrest default also sat on the 10GB AMI root volume, which archive-get's replica-catch-up queue could fill.
+spool-path = /data/pgbackrest_spool
 start-fast = y
 # Note: the [supabase] stanza (pg1-path, pg1-socket-path, pg1-user) has been
 # removed from this file. supabase-admin-agent owns that stanza and writes it
diff --git a/ansible/files/postgresql_config/sbpostgres_apparmor b/ansible/files/postgresql_config/sbpostgres_apparmor
index af35e9bb59..8240bf9596 100644
--- a/ansible/files/postgresql_config/sbpostgres_apparmor
+++ b/ansible/files/postgresql_config/sbpostgres_apparmor
@@ -125,7 +125,9 @@ profile sbpostgres flags=(attach_disconnected) {
         /var/lib/postgresql/data/standby.signal rw,
         /var/lib/pgbackrest rw,
         /etc/pgbackrest/conf.d/** rw,
-        /var/spool/pgbackrest/** rw,
+        # bare-dir grant needed alongside ** (same pg_wal/ pattern above) since ** doesn't cover the directory inode itself
+        /data/pgbackrest_spool/ rw,
+        /data/pgbackrest_spool/** rw,
         /var/log/pgbackrest/** rw,
         /etc/** r,
         /usr/local/** r,
@@ -188,7 +190,9 @@ profile sbpostgres flags=(attach_disconnected) {
         /var/lib/postgresql/data/standby.signal rw,
         /var/lib/pgbackrest rw,
         /etc/pgbackrest/conf.d/** rw,
-        /var/spool/pgbackrest/** rw,
+        # bare-dir grant needed alongside ** (same pg_wal/ pattern above) since ** doesn't cover the directory inode itself
+        /data/pgbackrest_spool/ rw,
+        /data/pgbackrest_spool/** rw,
         /var/log/pgbackrest/** rw,
         /etc/** r,
         /usr/local/** r,
diff --git a/ansible/tasks/setup-pgbackrest.yml b/ansible/tasks/setup-pgbackrest.yml
index 6d4eebcdb1..b5d458160f 100644
--- a/ansible/tasks/setup-pgbackrest.yml
+++ b/ansible/tasks/setup-pgbackrest.yml
@@ -47,7 +47,8 @@
     # (running as the pgbackrest user) cannot read conf files created by adminapi.
     - {dir: /etc/pgbackrest/conf.d, mode: '02770'}
     - {dir: /var/lib/pgbackrest}
-    - {dir: /var/spool/pgbackrest}
+    # must match spool-path in ansible/files/pgbackrest_config/pgbackrest.conf; in production (stage2, non-qemu) builds, setup-postgres.yml already mounted /data as its own volume by the time this task runs, since it's imported earlier in playbook.yml
+    - {dir: /data/pgbackrest_spool}
     - {dir: /var/log/pgbackrest}
   loop_control:
     loop_var: backrest_dir