diff --git a/packages/server/src/utils/backups/redact.ts b/packages/server/src/utils/backups/redact.ts
index fd4f62c50..d1d673d29 100644
--- a/packages/server/src/utils/backups/redact.ts
+++ b/packages/server/src/utils/backups/redact.ts
@@ -1,12 +1,11 @@
 /**
  * Redacts credentials from rclone command strings before they reach logs or
  * user-facing error output. Handles both the existing S3 flags and the
- * provider-specific FTP/SFTP password flags generated by the destination
- * builder.
+ * provider-specific FTP/SFTP credential flags used by backup destinations.
  */
 export const redactRcloneCredentials = (command: string): string => {
 	return command.replace(
-		/(--(?:s3-access-key-id|s3-secret-access-key|ftp-pass|sftp-pass)=)(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s]+)/g,
+		/(--(?:s3-access-key-id|s3-secret-access-key|ftp-pass|sftp-pass|sftp-key-file-pass)=)(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s]+)/g,
 		'$1"[REDACTED]"',
 	);
-};
+};
\ No newline at end of file