diff --git a/services/backup.sh b/services/backup.sh
index 543c778..54d6e57 100644
--- a/services/backup.sh
+++ b/services/backup.sh
@@ -727,7 +727,13 @@ install_backup() {
         echo "         e.g. s3.us-west-004.backblazeb2.com — you'll need it below."
         echo ""
         echo "  2) Account → App Keys → Add a New Application Key"
-        echo "       - Allow access to: the bucket you just created (not 'All')"
+        echo "       - Allow access to: All — confirmed live (kopia/kopia issue #5329): a key"
+        echo "         restricted to one bucket via this basic form doesn't get the"
+        echo "         'listBuckets' capability Kopia needs even though it only ever touches"
+        echo "         that one bucket, and B2 fails the connection with an unhelpful 'Cannot"
+        echo "         access bucket' error. Restricting to one bucket only works if you add"
+        echo "         listBuckets via the B2 CLI/API's own key-creation call instead of this"
+        echo "         form — not something this walkthrough covers."
         echo "       - Type: Read and Write"
         echo "       - B2 shows the application key ONLY once — copy both values now,"
         echo "         you can't retrieve the key itself again afterward."